CVE-2021-28560: Adobe Acrobat Reader DC heap buffer overflow via malicious file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with no privileges required and high EPSS, but exploitation requires user interaction and there is no KEV or confirmed in-the-wild evidence in the record.

What it is

Adobe Acrobat Reader DC (and Acrobat) versions 2021.001.20150, 2020.001.30020, and 2017.011.30194 and earlier contain a heap-based buffer overflow (CWE-122). Opening a crafted file can corrupt heap memory and lead to code execution in the context of the current user. Because Reader is widely deployed for opening untrusted documents, this is a serious client-side risk.

Impact

An attacker who gets a victim to open a malicious file can execute arbitrary code with the privileges of the logged-in user, enabling data theft, further compromise of the host, or installation of additional malware.

Attack surface

Reached over the network by delivering a malicious file that the victim must open in Acrobat Reader DC or Acrobat; no authentication is required, but user interaction (opening the file) is necessary per the CVSS vector AV:N/AC:L/PR:N/UI:R.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented; EPSS is high (0.66918, 99.26th percentile), indicating elevated predicted exploitation likelihood, but the record provides no confirmed in-the-wild exploitation evidence.

What to do

• Update Acrobat Reader DC and Acrobat to the fixed versions in Adobe security bulletin APSB21-29 (or later).
• If immediate patching is not possible, restrict or disable JavaScript and other risky features in Reader and limit opening of untrusted PDFs.
• Enforce Protected View/Protected Mode and block untrusted file types at email and web gateways.
• Run Reader with least privilege and consider application isolation or sandboxing for document handling.
• Track affected versions (2021.001.20150, 2020.001.30020, 2017.011.30194 and earlier) and verify remediation across endpoints.

Detection

• Monitor for Acrobat Reader/Acrobat processes spawning child processes or making unexpected network connections after opening documents.
• Alert on crashes or heap corruption events in Acrobat Reader/Acrobat, especially correlated with recently received files.
• Hunt for PDFs delivered via email or web downloads that are opened by Reader on endpoints with unpatched versions.
• Use EDR to detect anomalous memory operations or shellcode-like behavior in Reader process space.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.