CVE-2023-21608

What it actually does

This is a use-after-free vulnerability in Adobe Acrobat and Adobe Acrobat Reader that can be triggered when the application parses a specially crafted PDF or related document content. Successful exploitation allows attacker-controlled code to execute with the privileges of the user who opened the malicious file. Because the CVSS impact is high for confidentiality, integrity, and availability, exploitation can enable data theft, malware installation, persistence setup, or further lateral movement if the compromised user has access to additional resources.

Why it matters to the business

A malicious document can compromise a workstation simply by convincing a user to open it in a vulnerable version of Acrobat or Reader. This creates a high-risk phishing and document-delivery threat to organizations that rely on PDF workflows, especially because the vulnerability is listed in CISA KEV, has been exploited in the wild, and had a federal remediation deadline of 2023-10-31. Business consequences can include endpoint compromise, theft of sensitive documents, disruption from malware, investigation and recovery costs, and potential follow-on compromise of accounts or internal systems accessible to the affected user.

How an attack unfolds

An attacker prepares a weaponized PDF that triggers the Acrobat or Reader memory-management flaw. The attacker delivers the file through email, a download link, a collaboration platform, removable media, or another social-engineering route. When a user opens the file with a vulnerable Acrobat or Reader version, the crafted content causes a use-after-free condition and redirects execution flow to attacker-controlled code. The exploit then typically launches shellcode or a dropper in the context of the current user. Post-exploitation activity may include downloading a payload, spawning script interpreters or living-off-the-land binaries, writing files to temporary or user-profile paths, establishing persistence, collecting documents or credentials available to the user, and communicating with attacker infrastructure. Public reporting and KEV status indicate real-world exploitation, so detection should prioritize both initial malicious-document execution and post-exploitation behavior from Acrobat-family processes.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to a vendor-supported fixed release or the latest available version for the installed track and platform. For the vulnerable 22.003.20282 / 22.003.20281 and earlier continuous-track releases, update to at least the January 2023 fixed continuous release, commonly referenced as 22.003.20310, or later. For the vulnerable 20.005.30418 and earlier Classic 2020 releases, update to at least the January 2023 fixed Classic 2020 release, commonly referenced as 20.005.30436, or later. If immediate patching is not possible, reduce exposure by disabling PDF preview handlers where feasible, enforcing Protected View and Enhanced Security in Acrobat/Reader, blocking untrusted PDF attachments from external senders, restricting Acrobat/Reader child-process creation through EDR or application control, and ensuring users do not run with unnecessary administrative privileges. Because this vulnerability is in CISA KEV and actively exploited, compensating controls should be considered temporary only.

How to confirm the fix worked

Confirm that all installations of Adobe Acrobat and Adobe Acrobat Reader are above the vulnerable versions: 22.003.20282 / 22.003.20281 and earlier for affected continuous releases, and 20.005.30418 and earlier for affected Classic 2020 releases. Validate version inventory using endpoint management tooling, software inventory scans, application control inventory, or direct product version checks on Windows and macOS. On Windows, verify the installed AcroRd32.exe or Acrobat.exe file version and installed application version from Programs and Features or endpoint inventory. On macOS, verify the application bundle version for Adobe Acrobat Reader or Adobe Acrobat. Test that managed update policies are successfully applying Adobe updates and that users cannot continue launching obsolete vulnerable copies from unmanaged locations. Confirm mitigations by validating that Acrobat/Reader cannot spawn high-risk child processes such as PowerShell, cmd, mshta, wscript, cscript, rundll32, or regsvr32 unless explicitly required.

Typical attack path

1. Attacker identifies organizations or users likely to open PDF attachments or links.
2. Attacker crafts or obtains a malicious PDF that exploits the use-after-free condition in vulnerable Adobe Acrobat or Reader versions.
3. Attacker delivers the document through phishing email, web download, file-sharing service, or another user-interaction channel.
4. Victim opens the malicious file in an affected Acrobat or Reader application.
5. The malformed content triggers memory corruption and executes attacker-controlled code as the current user.
6. The exploit launches a payload, script interpreter, or living-off-the-land binary to establish execution outside the PDF reader process.
7. Attacker performs follow-on actions such as persistence, credential or document theft, command-and-control communication, or staging additional malware.

How to detect it

To determine whether exploitation already occurred, review endpoint, EDR, email, web proxy, and application logs for suspicious activity originating from Adobe Acrobat or Reader processes. Focus on the sequence of a PDF being opened, an Acrobat/Reader crash or abnormal process behavior, and immediate child-process creation or payload download. On Windows, examine Security logs, Sysmon, PowerShell logs, Prefetch, Amcache/Shimcache, SRUM, browser download history, email attachment telemetry, and EDR process trees for AcroRd32.exe or Acrobat.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or other unexpected utilities. Look for files written shortly after PDF open events in user-writable directories such as Downloads, Desktop, AppData, Temp, Startup, or ProgramData, and for new Run keys, scheduled tasks, services, or startup-folder entries. On macOS, review Unified Logs, quarantine events, endpoint telemetry, LaunchAgents/LaunchDaemons, user Library paths, and network connections associated with Adobe Acrobat or Reader. Network detection should look for outbound connections made directly by Acrobat/Reader or by suspicious child processes shortly after document opening. Email and web telemetry should be searched for inbound PDF attachments or downloaded PDFs that correlate with endpoint alerts. Because no single public file hash or payload is inherent to the vulnerability, prioritize behavioral indicators over static IOCs.

• AcroRd32.exe spawning cmd.exe
• AcroRd32.exe spawning powershell.exe
• AcroRd32.exe spawning pwsh.exe
• AcroRd32.exe spawning wscript.exe
• AcroRd32.exe spawning cscript.exe
• AcroRd32.exe spawning mshta.exe
• AcroRd32.exe spawning rundll32.exe
• AcroRd32.exe spawning regsvr32.exe
• AcroRd32.exe spawning certutil.exe
• AcroRd32.exe spawning bitsadmin.exe
• AcroRd32.exe spawning curl.exe
• AcroRd32.exe spawning wget.exe
• Acrobat.exe spawning cmd.exe
• Acrobat.exe spawning powershell.exe
• Acrobat.exe spawning pwsh.exe
• Acrobat.exe spawning wscript.exe
• Acrobat.exe spawning cscript.exe
• Acrobat.exe spawning mshta.exe
• Acrobat.exe spawning rundll32.exe
• Acrobat.exe spawning regsvr32.exe
• Acrobat.exe spawning certutil.exe
• Acrobat.exe spawning bitsadmin.exe
• Acrobat.exe spawning curl.exe
• Acrobat.exe spawning wget.exe
• ParentImage=*\\AcroRd32.exe Image=*\\powershell.exe
• ParentImage=*\\AcroRd32.exe Image=*\\cmd.exe
• ParentImage=*\\AcroRd32.exe Image=*\\mshta.exe
• ParentImage=*\\AcroRd32.exe Image=*\\rundll32.exe
• ParentImage=*\\Acrobat.exe Image=*\\powershell.exe
• ParentImage=*\\Acrobat.exe Image=*\\cmd.exe
• ParentImage=*\\Acrobat.exe Image=*\\mshta.exe
• ParentImage=*\\Acrobat.exe Image=*\\rundll32.exe
• C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.lnk
• C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.vbs
• C:\\Users\\*\\AppData\\Local\\Temp\\*.ps1
• C:\\Users\\*\\AppData\\Local\\Temp\\*.vbs
• C:\\Users\\*\\AppData\\Local\\Temp\\*.js
• HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
• /Users/*/Library/LaunchAgents/*.plist
• /Library/LaunchAgents/*.plist
• /Library/LaunchDaemons/*.plist
• /Applications/Adobe Acrobat Reader.app
• /Applications/Adobe Acrobat DC/Adobe Acrobat.app

What your security team should do

• Treat this as urgent where vulnerable Acrobat or Reader versions remain because the issue is in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score.
• Inventory all Adobe Acrobat and Adobe Acrobat Reader installations across Windows and macOS and prioritize remediation of versions 22.003.20282 / 22.003.20281 and earlier and 20.005.30418 and earlier.
• Patch to the latest supported Adobe Acrobat or Reader release; if using fixed baselines, ensure continuous-track systems are at least 22.003.20310 and Classic 2020 systems are at least 20.005.30436.
• Deploy or tune EDR rules for suspicious Acrobat/Reader child processes, especially command shells, script interpreters, LOLBins, archive utilities, and unexpected network-capable binaries.
• Hunt historically for Acrobat/Reader process crashes followed by child-process execution, file drops, persistence changes, or outbound network connections.
• Strengthen email and web controls for PDF attachments and links, including sandboxing, detonation, and blocking of newly observed or suspicious sender infrastructure.
• Enable Adobe Protected View and Enhanced Security where operationally feasible and restrict JavaScript in PDFs if not required.
• Review endpoint detections around the KEV remediation deadline and any period when vulnerable versions were present, because exploitation may have occurred before patch deployment.