CVE-2023-38244: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability. The vulnerability was discovered and reported on June 8, 2023, and was publicly disclosed on August 14, 2023. This security flaw affects both Adobe Acrobat and Acrobat Reader DC products (ZDI Advisory, Adobe Advisory).

The vulnerability is classified as an out-of-bounds read vulnerability (CWE-125) that occurs within the parsing of embedded fonts. The issue stems from inadequate validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has received a CVSS 3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

This vulnerability could lead to the disclosure of sensitive memory information. An attacker could potentially leverage this vulnerability to bypass security mitigations such as Address Space Layout Randomization (ASLR). The exploitation requires user interaction, specifically requiring a victim to open a malicious file (CVE).

The vulnerability requires local access and user interaction for successful exploitation. An attacker would need to convince a user to open a malicious file to trigger the vulnerability. The exploit can be leveraged in conjunction with other vulnerabilities to potentially execute arbitrary code in the context of the current process (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Acrobat and Reader installations to the latest versions that contain the fix for this vulnerability (Adobe Advisory).