Vulnerability record · CVE-2021-28635 · published 20 August 2021
CVE-2021-28635: Adobe Acrobat Reader DC use-after-free allows code execution
Adobe · Acrobat Dc
Acrobat Reader DC and Acrobat DC contain a use-after-free (CWE-416) flaw in the listed versions and earlier. An attacker can trigger it with a malicious file, and successful exploitation runs arbitrary code as the current user. Because Reader is widely deployed and opens untrusted documents by design, this is a serious client-side risk.
Description
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.8 with high EPSS and a client-side code execution primitive in a ubiquitous document reader make this a high-priority patching target despite no KEV listing.
What it is
Acrobat Reader DC and Acrobat DC contain a use-after-free (CWE-416) flaw in the listed versions and earlier. An attacker can trigger it with a malicious file, and successful exploitation runs arbitrary code as the current user. Because Reader is widely deployed and opens untrusted documents by design, this is a serious client-side risk.
Impact
An attacker gains arbitrary code execution in the context of the current user, which can lead to data theft, further compromise of the host, or installation of additional malware.
Attack surface
Reached locally when a victim opens a crafted file in the affected Acrobat product; no authentication is required, but user interaction (opening the file) is required per the CVSS vector AV:L/UI:R.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is high at 0.51184 (98.9th percentile), indicating elevated likelihood of attempted exploitation.
What to do
- Update Acrobat Reader DC and Acrobat DC to the fixed versions in Adobe advisory APSB21-51 or later.
- Where patching is delayed, restrict opening of untrusted PDFs and disable JavaScript in Acrobat.
- Enable Protected View/Protected Mode and keep it enforced for all documents.
- Block or sandbox PDF attachments at the email and web gateway.
- Track affected endpoints with software inventory and prioritize those still on the listed versions.
Detection
- Monitor for Acrobat Reader processes spawning child processes such as cmd.exe, powershell.exe, or script hosts.
- Alert on Acrobat crashes or use-after-free related faulting module events in endpoint telemetry.
- Hunt for PDF files written to temp or download directories that are immediately opened by Acrobat.
- Review proxy and email logs for PDFs from untrusted senders or newly registered domains.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat/apsb21-51.html | PatchVendor Advisory |
| https://helpx.adobe.com/security/products/acrobat/apsb21-51.html | PatchVendor Advisory |
Track CVE-2021-28635 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-28635), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
