CVE-2021-39843highCWE-787

CVE-2021-39843: high-severity vulnerability in Adobe Acrobat Reader

Adobe Acrobat Reader XObject Out-of-Bound Write Vulnerability

Published · Updated

Follow this CVE+ Monitor Acrobat Reader

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 77%
In short

Adobe Acrobat Reader has a memory flaw that allows attackers to run malicious code on your computer if you open a specially crafted PDF file. This happens because the software writes data beyond the intended memory boundaries.

Technical detail

Out-of-bounds write vulnerability in Adobe Acrobat Reader (versions 2021.005.20060 and earlier, 2020.004.30006 and earlier, 2017.011.30199 and earlier) allowing arbitrary code execution with user privileges. Attack vector requires user interaction to open a malicious PDF file, exploiting unsafe memory operations in XObject handling.

Summary generated and translated by AI from the official description.
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Adobe · Acrobat Reader
Related CVEs — Adobe Acrobat Reader

In the same product, most dangerous first.

CVE-2021-21017HIGHAcrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 86.3%KEVCVE-2023-21608HIGHAdobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityEPSS 59.4%KEVCVE-2021-28550CRITICALAdobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionEPSS 52.1%KEVCVE-2023-26369HIGH[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildEPSS 6.7%KEVCVE-2021-39836HIGHAdobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution VulnerabilityEPSS 69.5%CVE-2021-28560HIGHAdobe Acrobat Reader heap corruption vulnerability could lead to arbitrary code executionEPSS 66.9%