CVE-2021-28560highCWE-122

CVE-2021-28560: high-severity vulnerability in Adobe Acrobat Reader

Adobe Acrobat Reader heap corruption vulnerability could lead to arbitrary code execution

Published · Updated

Follow this CVE+ Monitor Acrobat Reader

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 67%
In short

Adobe Acrobat Reader has a memory corruption flaw that allows attackers to run malicious code on your computer if you open a specially crafted PDF file. This is dangerous because it gives attackers full control over your system with your user privileges.

Technical detail

A heap-based buffer overflow in Acrobat Reader DC (versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, 2017.011.30194 and earlier) allows unauthenticated remote code execution when a victim opens a malicious PDF file. The vulnerability exploits memory corruption to execute arbitrary code in the user's context without requiring elevated privileges.

Summary generated and translated by AI from the official description.
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Adobe · Acrobat Reader
Related CVEs — Adobe Acrobat Reader

In the same product, most dangerous first.

CVE-2021-21017HIGHAcrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 86.3%KEVCVE-2023-21608HIGHAdobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityEPSS 59.4%KEVCVE-2021-28550CRITICALAdobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionEPSS 52.1%KEVCVE-2023-26369HIGH[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildEPSS 6.7%KEVCVE-2021-39843HIGHAdobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityEPSS 76.7%CVE-2021-39836HIGHAdobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution VulnerabilityEPSS 69.5%