Evidence dossier

CVE-2023-26369

[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild

64.8–79.8Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

State: PUBLISHED
Published: Sep 13, 2023
Updated: Oct 21, 2025
Evidence coverage: 85%

CISA KEVCatalog member

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

FIRST EPSS7.04%

2026-07-18 · v2026.06.15 · percentile 93.5%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

adobeoriginal assertion

container

[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild

Jul 19, 2026Original evidence ↗

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

CVEderivative copy

container

CVE Program Container

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.070360000000; percentile 0.934670000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

AdobeAcrobat Reader

[{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "20.005.30514"}]unknown