CVE-2021-28639: Adobe Acrobat Reader DC use-after-free allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.8 with arbitrary code execution in a widely used document reader and a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is provided.

What it is

Acrobat Reader DC versions 2021.005.20054, 2020.004.30005, 2017.011.30197 and earlier contain a use-after-free (CWE-416) flaw. An unauthenticated attacker can trigger it to execute arbitrary code in the context of the current user. Because Reader is widely deployed for opening untrusted PDFs, the flaw matters for any environment where users open files from external sources.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the user running Acrobat Reader DC. That can lead to data theft, further compromise of the host, or installation of additional malware.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N): the victim must open a malicious file, typically a crafted PDF, in the affected Reader. No authentication is needed to reach the vulnerable code.

Exploitation

The record shows no CISA KEV listing and no public exploit references; EPSS is high at 0.66052 (99.2nd percentile), indicating elevated predicted exploitation activity, but the supplied references are only Adobe's vendor advisory and release notes.

What to do

• Update Acrobat Reader DC and Acrobat DC to the fixed versions listed in Adobe security bulletin APSB21-51.
• If immediate patching is not possible, restrict or disable JavaScript in Acrobat Reader and block untrusted PDFs from external sources.
• Enable Protected View/Protected Mode and run Reader with reduced privileges where supported.
• Apply application allowlisting and endpoint controls to limit what code can execute after a Reader compromise.
• Educate users not to open PDFs from unknown or unexpected senders.

Detection

• Monitor for Acrobat Reader processes spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Hunt for unusual file writes or network connections originating from AcroRd32.exe or Acrobat.exe.
• Review endpoint telemetry for crashes or memory corruption events in Acrobat Reader tied to recently opened PDFs.
• Track Reader version inventory to identify hosts still running the affected builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.