CVE-2023-38237: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability. The vulnerability was reported on May 26, 2023, and publicly disclosed on August 14, 2023. This security issue affects Adobe Acrobat Reader DC and its classic versions (NVD Database, ZDI Advisory).

The vulnerability is classified as an out-of-bounds read (CWE-125) that occurs within the parsing of embedded fonts. The issue stems from inadequate validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD Database, ZDI Advisory).

The vulnerability could lead to the disclosure of sensitive memory information. An attacker could potentially leverage this vulnerability to bypass security mitigations such as Address Space Layout Randomization (ASLR). The exploitation requires user interaction, specifically opening a malicious file (NVD Database).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat Reader DC (Adobe Advisory).