Adobe has released fixes for vulnerabilities spanning 15 products, including Acrobat and Reader, ColdFusion, Photoshop, Premiere Pro, Audition and After Effects. The security issues include multiple flaws that could enable arbitrary code execution, prompting New York’s Office of Information Technology Services to advise organizations to apply Adobe’s updates after testing. The state alert was issued Nov. 14, 2023, and links to Adobe’s product-specific security bulletins.
The broadest risk is concentrated in Acrobat and Reader, where Adobe addressed use-after-free, out-of-bounds read and write, and uninitialized-pointer vulnerabilities. The affected builds included Acrobat and Acrobat Reader DC 23.006.20360 and earlier, as well as Acrobat and Reader 2020 20.005.30524 and earlier. The advisory identifies CVE-2023-44336, CVE-2023-44359, CVE-2023-44367, CVE-2023-44371 and CVE-2023-44372 among the code-execution flaws, alongside CVE-2023-44337, CVE-2023-44338, CVE-2023-44365 and CVE-2023-44366.
ColdFusion administrators face a separate set of server-side issues, including three deserialization vulnerabilities—CVE-2023-44350, CVE-2023-44351 and CVE-2023-44353—that Adobe classified as capable of arbitrary code execution. The affected releases were ColdFusion 2023 Update 5 and earlier and ColdFusion 2021 Update 11 and earlier. Adobe also fixed a path-traversal code-execution issue in RoboHelp Server 11.4 and earlier, tracked as CVE-2023-22273.
Client applications were also exposed to memory-safety bugs. Adobe listed arbitrary-code-execution vulnerabilities in Photoshop 2023 version 24.7.1 and earlier, InCopy 18.5 and earlier, Media Encoder 24.0.2 and earlier, Audition 24.0 and earlier, Premiere Pro 24.0 and earlier, and After Effects 24.0.2 and earlier. The affected set also included InDesign, Bridge, FrameMaker Publishing Server, Animate and Dimension, although several of those products’ reported impacts were memory exposure, denial of service or security-feature bypass rather than code execution.
The New York alert does not provide NVD CVSS scores or identify a public proof of concept, and it says there were no reports of exploitation in the wild when the advisory was issued. That absence should not be treated as a guarantee of safety: memory-corruption flaws in widely deployed creative and document software can become useful once reverse engineers compare vulnerable and fixed builds. Administrators should inventory installed versions, prioritize internet-facing ColdFusion and RoboHelp systems, and install the updates in Adobe’s security bulletin index; organizations should also run affected applications with the least privilege practical to limit post-exploitation impact.
