Vulnerabilities in Adobe Acrobat, Microsoft Excel could lead to arbitrary code execution

Summary: Cisco Talos worked with Adobe and Microsoft to patch use-after-free vulnerabilities in Acrobat Reader (CVE-2023-44336 in the Thermometer JavaScript object and CVE-2023-44372 in page event processing) and in Excel within Office Professional Plus 2019 (CVE-2023-36041 in ElementType attribute parsing), all of which could lead to arbitrary code execution. Talos also disclosed six vulnerabilities in the Weston Embedded µC-HTTP server, including memory corruption issues CVE-2023-28391, CVE-2023-28379 and CVE-2023-31247 that could lead to code execution on the targeted device via a specially crafted packet.
Why it matters: Acrobat is one of the most popular PDF readers in the U.S. and many browsers use its plugin, so an attacker only needs to trick a user into opening a crafted file in the browser or desktop application to reach code execution.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-24585 CVE-2023-25181 CVE-2023-27882 CVE-2023-28379 CVE-2023-28391 CVE-2023-31247 CVE-2023-36041 CVE-2023-44336 CVE-2023-44372
Related: Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026