CVE-2021-21017highunder attackCWE-122

CVE-2021-21017: high-severity vulnerability in Adobe Acrobat Reader

Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution

Published · Updated

95Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 86%
from disclosure to weapon15 days
Published on NVDFeb 11
1st PoC+15d
CISA KEV+265d
exploitation probability
86%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

Acrobat Reader DC has a memory flaw that lets attackers run malicious code on your computer if you open a specially crafted PDF file. This is dangerous because it gives attackers full control over your system.

Technical detail

A heap-based buffer overflow in Acrobat Reader DC (versions 2020.013.20074 and earlier, 2020.001.30018 and earlier, 2017.011.30188 and earlier) allows unauthenticated attackers to execute arbitrary code with user privileges. The attack vector requires user interaction—opening a malicious PDF file—but once executed, it achieves code execution in the current user context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Adobe · Acrobat Reader
public PoCs found — 2
githubgithub.com/ZeusBox/CVE-2021-21017★ 44vulncheckvulncheck.com/xdb/457522b96e6dunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe Acrobat Reader

In the same product, most dangerous first.

CVE-2023-21608HIGHAdobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityEPSS 61.5%KEVCVE-2021-28550CRITICALAdobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionEPSS 51.9%KEVCVE-2023-26369HIGH[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildEPSS 6.7%KEVCVE-2021-39843HIGHAdobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityEPSS 76.7%CVE-2021-39836HIGHAdobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution VulnerabilityEPSS 69.5%CVE-2021-28560HIGHAdobe Acrobat Reader heap corruption vulnerability could lead to arbitrary code executionEPSS 66.9%
References
https://helpx.adobe.com/security/products/acrobat/apsb21-09.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21017