CVE-2021-28550: Adobe Acrobat and Reader use-after-free allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability, no privileges required and confirmed KEV exploitation make this a high-priority patch despite the user-interaction requirement.

What it is

Adobe Acrobat Reader DC (2021.001.20150, 2020.001.30020, 2017.011.30194 and earlier) and related Acrobat products contain a use-after-free (CWE-416) flaw. An unauthenticated attacker can trigger it with a crafted file that the victim opens, leading to arbitrary code execution as the current user. It is listed in CISA KEV, so it has been exploited in the wild.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the current user, enabling data theft, further payload delivery or host compromise.

Attack surface

Reached over the network via a malicious file opened in Acrobat or Reader; no authentication is required, but user interaction (opening the file) is required per the CVSS vector AV:N/AC:L/PR:N/UI:R.

Exploitation

CISA added it to KEV on 2021-11-03 with a 2021-11-17 remediation due date, and EPSS is 0.52005 (98.9th percentile), indicating active exploitation and high likelihood. No ransomware campaign use is recorded.

What to do

• Apply the Adobe updates referenced in advisory APSB21-29 for all affected Acrobat and Reader versions.
• Upgrade to a supported release line and remove or block end-of-life versions such as 2017.011.30194 and earlier.
• Disable or restrict JavaScript in Acrobat/Reader and enable Protected View/Protected Mode where feasible.
• Block untrusted PDFs at email and web gateways and warn users against opening unexpected attachments.
• Track KEV remediation deadlines and verify patched versions across endpoints.

Detection

• Hunt for Acrobat/Reader processes spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Monitor for PDF files written to temp or user directories followed by Acrobat/Reader execution.
• Alert on Acrobat/Reader crashes or abnormal terminations that may indicate use-after-free exploitation attempts.
• Review proxy and email logs for PDFs from untrusted senders or newly registered domains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.