CVE-2023-26369

What it actually does

CVE-2023-26369 is an out-of-bounds write vulnerability in Adobe Acrobat and Acrobat Reader on Windows and macOS. A specially crafted PDF can cause memory corruption when opened, allowing attacker-controlled data to overwrite memory and execute arbitrary code with the privileges of the user running Acrobat or Reader. Because exploitation runs in the current user context, impact can include data theft, malware execution, persistence setup, and lateral movement if the compromised user has access to additional resources.

Why it matters to the business

Successful exploitation can turn a routine document-opening action into endpoint compromise. Organizations may face unauthorized access to files, credential theft, malware deployment, business email compromise, or follow-on intrusion activity. This vulnerability is listed in CISA KEV with a remediation due date of 2023-10-05 and has been observed exploited in the wild, so unpatched Acrobat and Reader installations should be treated as high-priority exposure even though user interaction is required. It is not currently marked as used in ransomware campaigns, but document-based code execution is commonly used for initial access.

How an attack unfolds

An attacker prepares a malicious PDF that triggers the out-of-bounds write condition in a vulnerable version of Adobe Acrobat or Reader. The attacker delivers the file through phishing email, a shared drive, a messaging platform, a compromised website, or another document-sharing workflow. When the victim opens the PDF, Acrobat or Reader parses the crafted content and corrupts process memory. If exploitation succeeds, shellcode or a payload executes as the current user. The attacker may then launch child processes, drop malware, steal documents or browser credentials, establish persistence, and communicate with command-and-control infrastructure. In enterprise intrusions, the initial PDF exploit may be followed by discovery, credential access, and movement to other systems reachable by the user.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to a version newer than the affected releases: 23.003.20284 and earlier for continuous-track versions, 20.005.30516 and earlier on Windows classic-track versions, and 20.005.30514 and earlier on macOS classic-track versions. Where exact package baselines are managed centrally, deploy the applicable Adobe security update or the latest available Acrobat/Reader release for Windows and macOS. Enable automatic updates where feasible. If immediate patching is not possible, reduce exposure by restricting PDF handling to patched viewers, blocking untrusted PDF attachments from high-risk sources, disabling unnecessary Acrobat JavaScript features where operationally acceptable, enforcing Protected View / sandboxing, and using endpoint controls to block Acrobat or Reader from spawning scripting engines, command shells, or download utilities.

How to confirm the fix worked

Confirm installed Acrobat and Reader versions across Windows and macOS endpoints and verify they are later than the affected versions. On Windows, check the installed application inventory, Adobe updater status, file versions for AcroRd32.exe and Acrobat.exe, and software management telemetry. On macOS, validate application bundle versions for Adobe Acrobat Reader or Adobe Acrobat. Test that automatic update policies are functioning and that vulnerable versions are no longer present in golden images, VDI pools, application catalogs, and unmanaged endpoints. Validate mitigations by confirming EDR or application-control policies alert on or block Acrobat/Reader child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, curl.exe, or certutil.exe.

Typical attack path

1. Attacker identifies targets likely to open PDF attachments or shared documents.
2. Attacker crafts or obtains a weaponized PDF that exploits the Acrobat/Reader out-of-bounds write vulnerability.
3. Attacker delivers the PDF through phishing, file sharing, web download, or another social-engineering channel.
4. Victim opens the malicious PDF using a vulnerable Acrobat or Reader version.
5. The PDF triggers memory corruption and executes attacker-controlled code in the context of the current user.
6. The payload spawns suspicious child processes, downloads additional tooling, or drops malware to disk.
7. Attacker performs credential theft, data collection, persistence, and possible lateral movement depending on user privileges and endpoint controls.

How to detect it

To determine whether exploitation already occurred, review EDR, process creation, email gateway, web proxy, crash, and file telemetry around times when users opened PDFs. Focus on vulnerable Acrobat/Reader versions followed by abnormal child processes, network connections, file writes, or crashes. On Windows, inspect process creation events such as Sysmon Event ID 1, Windows Security Event ID 4688, PowerShell logs, Defender for Endpoint timelines, application crash events, and Prefetch/Amcache/Shimcache artifacts. On macOS, review Unified Logs, Endpoint Security telemetry, quarantine events, application crash reports, LaunchAgent/LaunchDaemon creation, and recent file access metadata. Look for Acrobat or Reader spawning shells, script interpreters, rundll32/regsvr32/mshta, curl/certutil, or Office/script tooling. Correlate suspicious process activity with email attachments, downloaded PDFs, browser downloads, or files opened from collaboration platforms. Also review outbound network connections shortly after PDF open events, especially connections to newly registered domains, direct IP addresses, uncommon ports, or user-profile executables. Because exploitation uses memory corruption, the malicious document may not leave a simple static indicator; behavioral correlation is the most reliable approach.

• AcroRd32.exe
• Acrobat.exe
• AcroCEF.exe
• AcroRd32.exe spawned cmd.exe
• AcroRd32.exe spawned powershell.exe
• AcroRd32.exe spawned pwsh.exe
• AcroRd32.exe spawned wscript.exe
• AcroRd32.exe spawned cscript.exe
• AcroRd32.exe spawned mshta.exe
• AcroRd32.exe spawned rundll32.exe
• AcroRd32.exe spawned regsvr32.exe
• AcroRd32.exe spawned certutil.exe
• AcroRd32.exe spawned curl.exe
• Acrobat.exe spawned cmd.exe
• Acrobat.exe spawned powershell.exe
• Acrobat.exe spawned wscript.exe
• Acrobat.exe spawned cscript.exe
• Acrobat.exe spawned mshta.exe
• Acrobat.exe spawned rundll32.exe
• Acrobat.exe spawned regsvr32.exe
• Acrobat.exe spawned certutil.exe
• Acrobat.exe spawned curl.exe
• C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
• C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
• C:\Users\%USERNAME%\AppData\Roaming\Adobe\Acrobat\DC\JSCache
• C:\Users\%USERNAME%\AppData\Local\Adobe\Acrobat\DC
• /Applications/Adobe Acrobat Reader.app/Contents/MacOS/AdobeReader
• /Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/MacOS/AdobeAcrobat
• ~/Library/Application Support/Adobe/Acrobat/DC
• ~/Library/Logs/DiagnosticReports/AdobeReader_
• ~/Library/Logs/DiagnosticReports/AdobeAcrobat_

What your security team should do

• Prioritize immediate patching because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Inventory all Adobe Acrobat and Acrobat Reader installations on Windows and macOS, including non-persistent desktops and unmanaged endpoints.
• Deploy the latest Adobe Acrobat/Reader security updates or remove the software where it is not required.
• Create or tune EDR detections for Acrobat/Reader spawning command interpreters, scripting engines, LOLBins, archive utilities, or network download tools.
• Hunt retrospectively for suspicious PDF-opening events followed by child process execution, file drops, credential access tools, or outbound network connections.
• Harden email and web gateways to detonate or block suspicious PDFs, especially documents from external senders or newly registered domains.
• Restrict Acrobat/Reader from making unnecessary outbound connections and from launching child processes using application control where feasible.
• Review endpoint alerts around the original KEV remediation deadline and after publication for evidence of exploitation attempts against unpatched systems.