CVE-2023-38240: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that was disclosed on August 8, 2023. The vulnerability affects both Adobe Acrobat and Acrobat Reader applications across multiple platforms including Windows and macOS (Adobe Advisory, NVD Entry).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) that specifically occurs during the parsing of embedded fonts. The flaw stems from inadequate validation of user-supplied data, which can result in reading past the end of an allocated object. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (ZDI Advisory, Adobe Advisory).

The vulnerability could lead to the disclosure of sensitive memory information. If successfully exploited, an attacker could potentially bypass security mitigations such as Address Space Layout Randomization (ASLR). The impact is limited to information disclosure, with no direct impact on system integrity or availability (NVD Entry).

Adobe has released security updates to address this vulnerability. Users should update their Adobe Acrobat and Reader installations to the latest versions available through the standard update channels (Adobe Advisory).