CVE-2023-38248: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability identified as CVE-2023-38248. The vulnerability was discovered on July 13, 2023, and publicly disclosed on August 8, 2023. This security flaw affects both Windows and macOS versions of Adobe Acrobat and Reader (Adobe Advisory, ZDI Advisory).

The vulnerability is classified as an out-of-bounds read vulnerability (CWE-125) that occurs during the parsing of PDF files. The issue stems from improper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD, ZDI Advisory).

The vulnerability could lead to disclosure of sensitive memory and potentially allow attackers to bypass security mitigations such as Address Space Layout Randomization (ASLR). This could enable attackers to leverage the vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (NVD, ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users should update their Adobe Acrobat and Reader installations to the latest versions available through the official Adobe security advisory (Adobe Advisory).