Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 20.005.30467 or 23.001.20143. It is, therefore, affected by multiple vulnerabilities.

  - Out-of-bounds Write (CWE-787) potentially leading to Arbitrary code execution (CVE-2023-26395)

  - Violation of Secure Design Principles (CWE-657) potentially leading to Privilege escalation     (CVE-2023-26396)

  - Out-of-bounds Read (CWE-125) potentially leading to Memory leak (CVE-2023-26397)

  - Improper Input Validation (CWE-20) potentially leading to Arbitrary code execution (CVE-2023-26405,     CVE-2023-26407)

  - Improper Access Control (CWE-284) potentially leading to Security feature bypass (CVE-2023-26406,     CVE-2023-26408)

  - Use After Free (CWE-416) potentially leading to Arbitrary code execution (CVE-2023-26417, CVE-2023-26418,     CVE-2023-26419, CVE-2023-26420, CVE-2023-26422, CVE-2023-26423, CVE-2023-26424)

  - Integer Underflow (Wrap or Wraparound) (CWE-191) potentially leading to Arbitrary code execution     (CVE-2023-26421)

  - Out-of-bounds Read (CWE-125) potentially leading to Arbitrary code execution (CVE-2023-26425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 20.005.30467 or 23.001.20143. It is, therefore, affected by multiple vulnerabilities.

  - Out-of-bounds Write (CWE-787) potentially leading to Arbitrary code execution (CVE-2023-26395)

  - Violation of Secure Design Principles (CWE-657) potentially leading to Privilege escalation     (CVE-2023-26396)

  - Out-of-bounds Read (CWE-125) potentially leading to Memory leak (CVE-2023-26397)

  - Improper Input Validation (CWE-20) potentially leading to Arbitrary code execution (CVE-2023-26405,     CVE-2023-26407)

  - Improper Access Control (CWE-284) potentially leading to Security feature bypass (CVE-2023-26406,     CVE-2023-26408)

  - Use After Free (CWE-416) potentially leading to Arbitrary code execution (CVE-2023-26417, CVE-2023-26418,     CVE-2023-26419, CVE-2023-26420, CVE-2023-26422, CVE-2023-26423, CVE-2023-26424)

  - Integer Underflow (Wrap or Wraparound) (CWE-191) potentially leading to Arbitrary code execution     (CVE-2023-26421)

  - Out-of-bounds Read (CWE-125) potentially leading to Arbitrary code execution (CVE-2023-26425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote Windows host is a version prior to 20.005.30467 or 23.001.20143. It is, therefore, affected by multiple vulnerabilities.

  - Out-of-bounds Write (CWE-787) potentially leading to Arbitrary code execution (CVE-2023-26395)

  - Violation of Secure Design Principles (CWE-657) potentially leading to Privilege escalation     (CVE-2023-26396)

  - Out-of-bounds Read (CWE-125) potentially leading to Memory leak (CVE-2023-26397)

  - Improper Input Validation (CWE-20) potentially leading to Arbitrary code execution (CVE-2023-26405,     CVE-2023-26407)

  - Improper Access Control (CWE-284) potentially leading to Security feature bypass (CVE-2023-26406,     CVE-2023-26408)

  - Use After Free (CWE-416) potentially leading to Arbitrary code execution (CVE-2023-26417, CVE-2023-26418,     CVE-2023-26419, CVE-2023-26420, CVE-2023-26422, CVE-2023-26423, CVE-2023-26424)

  - Integer Underflow (Wrap or Wraparound) (CWE-191) potentially leading to Arbitrary code execution     (CVE-2023-26421)

  - Out-of-bounds Read (CWE-125) potentially leading to Arbitrary code execution (CVE-2023-26425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote macOS host is a version prior to 20.005.30467 or 23.001.20143. It is, therefore, affected by multiple vulnerabilities.

  - Out-of-bounds Write (CWE-787) potentially leading to Arbitrary code execution (CVE-2023-26395)

  - Violation of Secure Design Principles (CWE-657) potentially leading to Privilege escalation     (CVE-2023-26396)

  - Out-of-bounds Read (CWE-125) potentially leading to Memory leak (CVE-2023-26397)

  - Improper Input Validation (CWE-20) potentially leading to Arbitrary code execution (CVE-2023-26405,     CVE-2023-26407)

  - Improper Access Control (CWE-284) potentially leading to Security feature bypass (CVE-2023-26406,     CVE-2023-26408)

  - Use After Free (CWE-416) potentially leading to Arbitrary code execution (CVE-2023-26417, CVE-2023-26418,     CVE-2023-26419, CVE-2023-26420, CVE-2023-26422, CVE-2023-26423, CVE-2023-26424)

  - Integer Underflow (Wrap or Wraparound) (CWE-191) potentially leading to Arbitrary code execution     (CVE-2023-26421)

  - Out-of-bounds Read (CWE-125) potentially leading to Arbitrary code execution (CVE-2023-26425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
174137	Adobe Acrobat < 20.005.30467 / 23.001.20143 Multiple Vulnerabilities (APSB23-24) (macOS)	Nessus	MacOS X Local Security Checks	high
174136	Adobe Acrobat < 20.005.30467 / 23.001.20143 Multiple Vulnerabilities (APSB23-24)	Nessus	Windows	high
174135	Adobe Reader < 20.005.30467 / 23.001.20143 Multiple Vulnerabilities (APSB23-24)	Nessus	Windows	high
174134	Adobe Reader < 20.005.30467 / 23.001.20143 Multiple Vulnerabilities (APSB23-24) (macOS)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2023-26418

high

Tenable Plugins

high

high

high

high