CVE-2023-21611: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier), and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability (CVE-2023-21611). This security flaw was discovered and reported by Koh M. Nakagawa (Ko Kato) and was publicly disclosed in January 2023 (Adobe Advisory, NVD).

The vulnerability is classified as a Creation of Temporary File in Directory with Incorrect Permissions issue (CWE-379) and Exposure of Resource to Wrong Sphere (CWE-668). It has received a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating its significant severity (NVD).

If successfully exploited, this vulnerability could result in privilege escalation in the context of the current user. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected system (NVD).

Exploitation of this vulnerability requires user interaction, specifically that a victim must open a malicious file. The attack vector is local (AV:L), requiring the attacker to have local access to the target system (NVD).

Adobe has released security updates to address this vulnerability. Users should update their Adobe Acrobat and Reader installations to the latest versions available through the official Adobe update channels (Adobe Advisory).