CVE-2023-21605: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier), and 20.005.30418 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability identified as CVE-2023-21605. The vulnerability was reported on October 26, 2022, and publicly disclosed on January 18, 2023. This security flaw specifically affects the processing of embedded fonts in Adobe Acrobat Reader DC (ZDI Advisory, NVD Entry).

The vulnerability is classified as a Heap-based Buffer Overflow (CWE-122) that occurs during the processing of embedded fonts. The issue stems from inadequate validation of user-supplied data length before copying it to a fixed-length heap-based buffer. The vulnerability has received a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. The attacker could leverage this flaw to execute malicious code within the context of the current process (NVD Entry, ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat Reader DC (Adobe Advisory).