CVE-2021-28640: Adobe Acrobat Reader DC use-after-free allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.3 with arbitrary code execution and a very high EPSS percentile make this a high-priority patch despite no KEV listing.

What it is

Adobe Acrobat Reader DC and Acrobat DC contain a use-after-free (CWE-416) flaw in the listed versions. An authenticated attacker who convinces a victim to open a malicious file can execute arbitrary code in the context of the current user. The vulnerability is rated HIGH (CVSS 7.3) and has a high EPSS score, so it warrants prompt patching.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the user running Acrobat, enabling data theft, further compromise of the host, or installation of additional malware.

Attack surface

The flaw is reached locally when the victim opens a crafted file in the affected Acrobat product, requiring user interaction and an authenticated attacker context per the CVSS vector (AV:L/PR:L/UI:R). No remote unauthenticated vector is described.

Exploitation

CVE-2021-28640 is not listed in CISA KEV, but its EPSS 30-day probability is 0.53379 (99th percentile), indicating high predicted likelihood of exploitation. The only references are Adobe's vendor advisory and release notes; no public exploit or in-the-wild reporting is stated in the record.

What to do

• Apply the Adobe security update for APSB21-51 to move Acrobat and Reader to fixed versions.
• Upgrade to the latest supported Acrobat/Reader release and remove or block outdated versions.
• Disable or restrict JavaScript in Acrobat/Reader where operationally feasible.
• Train users not to open PDFs or attachments from untrusted sources.
• Enforce least privilege so Acrobat runs without administrative rights.

Detection

• Monitor for Acrobat/Reader processes spawning unexpected child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Review endpoint telemetry for Acrobat/Reader crashes or memory corruption events tied to document opens.
• Hunt for PDF files written to temp or download directories immediately preceding suspicious process creation.
• Track Acrobat/Reader version inventory to identify hosts still running the affected builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.