CVE-2023-26424

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Apr 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264257.8Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an out-of-bounds read vulnerability CVE-2023-264267.8Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitr CVE-2023-264273.3Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated t CVE-2023-264286.5Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of CVE-2023-264295.3Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feed CVE-2023-26439.8A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code CVE-2023-264304.3Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SI CVE-2023-264314.3IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user acc CVE-2023-264324.3When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access t CVE-2023-264334.3When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access t CVE-2023-264344.3When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access t CVE-2023-264355.0It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers co