⚡ TL;DR | Go Straight to the Adobe Acrobat (Reader) Vulnerability Report
On April 11th, Adobe released a series of updates addressing 56 vulnerabilities across 6 products. All of these vulnerabilities received a CVSS base score between 5.5 and 8.6, with most of them being critical. Exploitation could lead to a number of problems like arbitrary code execution, privilege escalation, security feature bypass, and memory leak. For your organization, this could result in the loss or even theft of business-critical or sensitive files and data, disruptions in business operations, and application failures.
As the vulnerabilities affect several different Adobe products and versions, you can find lists of the affected versions per product below. We have provided a report to help you find vulnerable installations of Adobe Acrobat and Reader for Windows. Of course, you can also use Lansweeper to find installations of the other products.
Affected Software and Versions
Adobe Acrobat and Reader
In Adobe Acrobat and Acrobat Reader for Windows and macOS, 16 vulnerabilities were fixed, 14 of which are critical. Successful exploitation of these vulnerabilities could lead to arbitrary code execution, privilege escalation, security feature bypass, and memory leak. Detailed instructions on how to update your installations can be found on Adobe’s bulletin.
| Product | Affected version | Updated Version | Availability |
| Acrobat DC | 23.001.20093 and earlier versions | 2.300.120.143 | Release notes |
| Acrobat Reader DC | 23.001.20093 and earlier versions | 2.300.120.143 | Release notes |
| Acrobat 2020 | 20.005.30441 and earlier versions | 2.000.530.467 | Release notes |
| Acrobat Reader 2020 | 20.005.30441 and earlier versions | 2.000.530.467 | Release notes |
Based on this list of affected products and versions in Adobe’s security bulletin, we have created a special Lansweeper report that will provide a list of all installations for Windows in your environment that could be affected by these vulnerabilities.
Adobe Digital Editions
The update to Adobe Digital Editions addresses 1 critical vulnerability that could result in arbitrary code execution. It recommends that you update your installation to the newest version.
| Product | Affected version | Updated Version | Availability |
| Adobe Digital Editions | 4.5.11.187303 and earlier versions | 4.5.11.187658 | Download Page |
Adobe InCopy
In Adobe Incopy for Windows and macOS, 1 critical vulnerability was fixed that could lead to arbitrary code execution. Adobe recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism. You can find more information on their help page.
| Product | Affected version | Updated Version |
| Adobe InCopy | 18.1 and earlier versions | 18.2 |
| 17.4 and earlier versions | 17.4.1 |
Substance 3D Stager
In Adobe Substance 3D Stager for Windows and macOS, 14 vulnerabilities have been patched, 10 of which were critical. Successful exploitation could lead to arbitrary code execution and memory leak in the context of the current user. Adobe recommends that you update your installation to the newest version via the Creative Cloud desktop app’s update mechanism. You can find more details on this help page.
| Product | Affected version | Updated Version | Availability |
| Adobe Substance 3D Stager | 2.0.1 and earlier versions | 2.0.2 | Download Center |
Substance 3D Designer
Another 9 vulnerabilities were patched in Substance 3D Designer, all of them critical. These could lead to arbitrary code execution in the context of the current user. Just like before, you can update your installation to the newest version via the Creative Cloud desktop app’s update mechanism. You can find more information on this help page.
| Product | Affected version | Updated Version | Availability |
| Adobe Substance 3D Designer | 12.4.0 and earlier versions | 12.4.0 and earlier versions | Download Center |
Adobe Dimension
15 more vulnerabilities were fixed in Adobe Dimension for Windows and macOS, 14 of which are critical, that could lead to memory leak and arbitrary code execution in the context of the current user. You are advised to update to the newest version via the Creative Cloud desktop app’s update mechanism. For more information, you can reference this help page.
| Product | Affected version | Updated Versions | Availability |
| Adobe Dimension | 3.4.8 and earlier versions | 3.4.9 | Download Center |
Discover Vulnerable Adobe Products
Just like we did for the Adobe Acrobat (Reader) vulnerabilities above, you can use Lansweeper to discover any installs of the vulnerable Adobe products and versions in your network. This way you have an actionable list of devices and software that might require a patch.
Adobe August 2022 CVE Codes & Categories
| CVE number | Vulnerability Category | CVSS base score | Affected Product |
| CVE-2023-26395 | Out-of-bounds Write | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26396 | Violation of Secure Design Principles | 6.6 | Adobe Acrobat and Reader |
| CVE-2023-26397 | Out-of-bounds Read | 5.5 | Adobe Acrobat and Reader |
| CVE-2023-26405 | Improper Input Validation | 8.6 | Adobe Acrobat and Reader |
| CVE-2023-26406 | Improper Access Control | 8.6 | Adobe Acrobat and Reader |
| CVE-2023-26407 | Improper Input Validation | 8.6 | Adobe Acrobat and Reader |
| CVE-2023-26408 | Improper Access Control | 8.6 | Adobe Acrobat and Reader |
| CVE-2023-26417 | Use After Free | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26418 | Use After Free | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26419 | Use After Free | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26420 | Use After Free | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26421 | Integer Underflow (Wrap or Wraparound) | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26422 | Use After Free | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26423 | Use After Free | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26424 | Use After Free | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-26425 | Out-of-bounds Read | 7.8 | Adobe Acrobat and Reader |
| CVE-2023-21582 | Out-of-bounds Write | 7.8 | Adobe Digital Editions |
| CVE-2023-22235 | Use After Free | 7.8 | Adobe InCopy |
| CVE-2023-26388 | Access of Memory Location After End of Buffer | 7.8 | Substance 3D Stager |
| CVE-2023-26389 | Out-of-bounds Read | 7.8 | Substance 3D Stager |
| CVE-2023-26390 | Stack-based Buffer Overflow | 7.8 | Substance 3D Stager |
| CVE-2023-26391 | Out-of-bounds Read | 7.8 | Substance 3D Stager |
| CVE-2023-26392 | Use After Free | 7.8 | Substance 3D Stager |
| CVE-2023-26393 | Out-of-bounds Read | 7.8 | Substance 3D Stager |
| CVE-2023-26394 | Heap-based Buffer Overflow | 7.8 | Substance 3D Stager |
| CVE-2023-26383 | Stack-based Buffer Overflow | 7.8 | Substance 3D Stager |
| CVE-2023-26384 | Use After Free | 7.8 | Substance 3D Stager |
| CVE-2023-26385 | Out-of-bounds Read | 5.5 | Substance 3D Stager |
| CVE-2023-26386 | Access of Memory Location After End of Buffer | 5.5 | Substance 3D Stager |
| CVE-2023-26387 | Access of Uninitialized Pointer | 5.5 | Substance 3D Stager |
| CVE-2023-26402 | Out-of-bounds Read | 7.8 | Substance 3D Stager |
| CVE-2023-26403 | Out-of-bounds Read | 5.5 | Substance 3D Stager |
| CVE-2023-26398 | Out-of-bounds Read | 7.8 | Substance 3D Designer |
| CVE-2023-26409 | Out-of-bounds Read | 7.8 | Substance 3D Designer |
| CVE-2023-26410 | Use After Free | 7.8 | Substance 3D Designer |
| CVE-2023-26411 | Out-of-bounds Read | 7.8 | Substance 3D Designer |
| CVE-2023-26412 | Stack-based Buffer Overflow | 7.8 | Substance 3D Designer |
| CVE-2023-26413 | Heap-based Buffer Overflow | 7.8 | Substance 3D Designer |
| CVE-2023-26414 | Use After Free | 7.8 | Substance 3D Designer |
| CVE-2023-26415 | Use After Free | 7.8 | Substance 3D Designer |
| CVE-2023-26416 | Heap-based Buffer Overflow | 7.8 | Substance 3D Designer |
| CVE-2023-26372 | Out-of-bounds Write | 7.8 | Adobe Dimension |
| CVE-2023-26373 | Out-of-bounds Write | 7.8 | Adobe Dimension |
| CVE-2023-26374 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26375 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26376 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26377 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26378 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26379 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26380 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26381 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26382 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26400 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26401 | Out-of-bounds Read | 5.5 | Adobe Dimension |
| CVE-2023-26404 | Out-of-bounds Read | 7.8 | Adobe Dimension |
| CVE-2023-26371 | Out-of-bounds Read | 7.8 | Adobe Dimension |
