How do you patch or mitigate CVE-2023-21608 (Adobe Acrobat and Reader Use-After-Free)?

CISA’s required action for CVE-2023-21608 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Adobe Acrobat and Reader in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What should you do first to patch CVE-2023-21608 safely?

Start with complete exposure discovery, because the practical risk is not limited to one desktop team or one browser plugin. Build an inventory of every Adobe Acrobat and Reader installation, then decide whether you can apply the vendor update immediately or must use the vendor mitigation path while you schedule removal or replacement.

For vulnerabilities that are already in active exploitation workflows, use CISA Known Exploited Vulnerabilities Catalog as the prioritisation trigger, and cross-check the record in NIST National Vulnerability Database and CVE Program for authoritative identifiers and record details.

How do mitigation and patching differ in practice for this flaw?

If Adobe has a security update available for your deployment path, apply it in the normal remediation window, but treat affected Reader and Acrobat endpoints as high priority until they are confirmed fixed. If the update cannot be deployed yet, use the documented mitigation exactly as published by the vendor, not an improvised workaround that changes document handling, macro behaviour, or user workflow without validation.

Where mitigation is the only immediate option, make the reduction in exposure measurable. Limit who can open untrusted PDFs, reduce external-facing access to the product, and remove internet exposure where the product cannot be safely maintained. If the product cannot be brought into a supportable state, discontinuing use is the correct control, not a temporary exception that becomes permanent.

What should you check after remediation?

After patching or mitigating, verify two things: first, that the vulnerable product instances are no longer exposed to the original attack path; second, that there is no sign the issue was used before remediation. For a use-after-free flaw, that means reviewing endpoint telemetry, user activity, and any document handling events that preceded the fix, then confirming the affected systems were not repeatedly re-opened to the same untrusted content source.

If the product was internet-reachable or used to process externally supplied files, preserve logs and determine whether attackers could have used the flaw before the fix landed. That investigation is often more important than proving the patch itself installed successfully, because exploited document readers can be an initial access vector rather than a standalone problem.

Risk and Threat Considerations

CVE-2023-21608 matters because a use-after-free in a document-handling application can be weaponised through a crafted file and delivered through ordinary user workflows. The immediate danger is not only application failure, but code execution or compromise of the workstation that opens the malicious document.

Failure mechanism: A malformed file can drive the application into unsafe memory state, letting an attacker abuse object lifetime errors during parsing or rendering.

Impact: Successful exploitation can expose the endpoint, enable follow-on payload delivery, and create a foothold for credential theft, persistence, or lateral movement if the user context is valuable.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Prioritises finding and remediating the vulnerable Acrobat/Reader estate.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	Supports hardening or removing exposed software when patching is delayed.
Recommendation — Identify affected installs quickly and drive remediation to completion. Apply secure configuration or remove unsupported exposure paths.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management Plan	Covers the process of triaging, remediating, and tracking an actively exploited flaw.
	PR.PS-01 — Configuration Management	Applies to deploying the vendor fix or approved mitigation consistently across endpoints.
	DE.CM-08 — Vulnerability Scanning	Supports confirming where Acrobat and Reader remain present and exposed.
Recommendation — Triage the CVE, set remediation priority, and track closure. Deploy the approved update or mitigation through controlled change. Scan for exposed vulnerable software and verify remediation coverage.

Practitioner Guidance

What to prioritise: Patch or mitigate the highest-exposure Reader and Acrobat installations first, especially systems that regularly open external PDFs, handle invoices, contracts, or other inbound documents, or are reachable from untrusted networks.

What to verify: Confirm the vendor update actually removed the vulnerable build from every endpoint, and do not trust a change record alone. If you must rely on mitigation, verify that the control is still in place after reboot, image refresh, or software repair.

Decision rule: If you cannot confirm timely remediation and cannot safely constrain exposure, take the product out of service until you can. A partially mitigated document reader that remains broadly exposed is still an incident waiting to happen.

Practitioner takeaway: For exploited document-reader flaws, the right measure of success is not just “patched,” it is “no longer reachable by untrusted content and no longer able to serve as an easy entry point.”