CVE-2023-21608

Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

HIGH

7.8

CVSS Score

Published: January 18, 2023 at 12:00 AM UTC

Updated: June 17, 2026 at 05:33 AM UTC

3 products affected across 1 vendorAcrobat ReaderAcrobatAcrobat DC· also runs on 2 platforms

Using Acrobat Reader by Adobe?

Get instant alerts when new vulnerabilities affect Acrobat Reader - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploitation

CISA KEV

Exploit prediction

EPSS 59%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score59.4%

EPSS (Exploit Prediction Scoring System) estimates a 59.4% chance this CVE is exploited in the wild within the next 30 days — higher than 99% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Oct 10, 2023

Remediation Due

Oct 31, 2023

1094 days overdue

Notes

https://helpx.adobe.com/security/products/acrobat/apsb23-01.html

https://nvd.nist.gov/vuln/detail/CVE-2023-21608

Description

Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.