CVE-2023-21613: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier), and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. The vulnerability was discovered and reported to Adobe on October 28, 2022, and was publicly disclosed on January 18, 2023 (ZDI Advisory).

The vulnerability is classified as an out-of-bounds read (CWE-125) that specifically occurs during the processing of embedded fonts in Adobe Acrobat Reader DC. When processing crafted data in a font, it can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

If exploited, this vulnerability could lead to the disclosure of sensitive memory information. More significantly, an attacker could leverage this vulnerability to bypass security mitigations such as Address Space Layout Randomization (ASLR) (CVE).

Adobe has issued an update to correct this vulnerability. Users should update to the latest version of Adobe Acrobat Reader that addresses this security issue (ZDI Advisory).