CVE-2021-39836: Adobe Acrobat Reader use-after-free in AcroForm buttonGetIcon action

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.8 with full confidentiality, integrity and availability impact and a very high EPSS score, though exploitation requires the victim to open a malicious file and no KEV listing or public exploit is confirmed.

What it is

Acrobat Reader DC (and related Acrobat products) contain a use-after-free (CWE-416) in the processing of the AcroForm buttonGetIcon action. A crafted PDF can corrupt memory and lead to arbitrary code execution in the context of the current user. The flaw affects versions 2021.005.20060, 2020.004.30006 and 2017.011.30199 and earlier per the advisory.

Impact

An attacker who gets a victim to open a malicious PDF can execute arbitrary code with the privileges of the logged-in user, giving full control of that user's session and data.

Attack surface

Reached locally by opening a crafted PDF; the CVSS vector (AV:L, UI:R, PR:N) indicates no authentication is needed but user interaction (opening the file) is required.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is high at 0.695 (99.3rd percentile), indicating elevated likelihood of exploitation activity.

What to do

• Update Acrobat Reader DC and Acrobat to the fixed versions in Adobe advisory APSB21-55 (2021.005.20068, 2020.004.30026, 2017.011.30202 or later).
• Where immediate patching is not possible, restrict or disable JavaScript and the buttonGetIcon-related form features via policy, and block untrusted PDFs at the gateway.
• Enforce Protected View / Protected Mode and disable automatic opening of PDFs from email and web downloads.
• Run Acrobat with least privilege and consider application allowlisting to limit post-exploitation impact.

Detection

• Monitor for Acrobat Reader processes spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for PDF viewing.
• Alert on Acrobat Reader crashes or memory-corruption events (Windows Error Reporting / crash dumps) tied to opening PDFs.
• Hunt for PDFs containing AcroForm buttonGetIcon actions or embedded JavaScript delivered via email or web download.
• Track endpoint and email telemetry for PDFs from untrusted sources opened by high-value users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.