Use‑After‑Free in Adobe Acrobat and Reader (CVE‑2023‑21608) Enables Code Execution
What It Is — Adobe Acrobat and Reader contain a use‑after‑free flaw that can allow an attacker to execute arbitrary code in the context of the current user.
Exploitability — Publicly disclosed; proof‑of‑concept code is available and the CVSS v3.1 base score is 8.8 (High). No known widespread active exploit at time of writing, but the vulnerability is readily weaponizable.
Affected Products — Adobe Acrobat DC and Adobe Reader DC on Windows, macOS, and Linux versions prior to the security update released 2023‑09‑12.
Why It Matters for Trust & Control Assurance
- Patch Management Discipline – Demonstrating a timely patch‑deployment process satisfies a core control objective that underpins many frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6).
- Defensible Audit Trail – Maintaining evidence that vulnerable versions were identified, remediated, and verified provides auditors with concrete proof of due diligence.
- Continuous Monitoring – Automated inventory and vulnerability scanning feed into a continuous‑control‑monitoring program, reducing the window of exposure and supporting a trustworthy security posture demanded by enterprise buyers.
Recommended Actions
- Deploy Adobe’s September 2023 security update to all Acrobat/Reader installations immediately.
- Verify patch status via a software‑inventory scan and document remediation evidence.
- Integrate the CVE into your vulnerability‑management workflow; map it to the “timely patching” control objective and capture compliance evidence.
- Monitor endpoint logs for anomalous process creation that could indicate exploitation attempts.
Source: CISA KEV – CVE‑2023‑21608