CVE-2023-26421

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Integer Underflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-191

Affected software

No affected versions have been published.

Timeline

Published: Apr 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264227.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that CVE-2023-264237.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that CVE-2023-264247.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that CVE-2023-264257.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an out-of-bounds read vulnerability CVE-2023-264267.8Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitr CVE-2023-264273.3Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated t CVE-2023-264286.5Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of CVE-2023-264295.3Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feed CVE-2023-26439.8A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code CVE-2023-264304.3Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SI CVE-2023-264314.3IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user acc CVE-2023-264324.3When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access t