CVE-2021-39838: Adobe Acrobat Reader use-after-free in AcroForm buttonGetCaption action

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS score is 7.8 (high) and EPSS probability is very high (0.65), though no active exploitation is confirmed in KEV.

What it is

Adobe Acrobat Reader DC (and related Acrobat products) contain a use-after-free vulnerability in the processing of the AcroForm buttonGetCaption action. A crafted PDF can trigger the flaw and potentially execute arbitrary code in the context of the current user. The issue affects versions 2021.005.20060 and earlier, 2020.004.30006 and earlier, and 2017.011.30199 and earlier.

Impact

An attacker who convinces a victim to open a malicious PDF can execute arbitrary code with the privileges of the current user, leading to full compromise of confidentiality, integrity, and availability on that system.

Attack surface

The vulnerability is reached locally when a user opens a specially crafted PDF file; no authentication is required, but user interaction (opening the file) is necessary.

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.65249, 99.2nd percentile). No public exploit references are provided in the record.

What to do

• Update Adobe Acrobat Reader DC and Acrobat to the latest patched versions as described in Adobe security bulletin APSB21-55.
• If immediate patching is not possible, disable or restrict JavaScript execution in Acrobat Reader and avoid opening untrusted PDF files.
• Enable Protected View or Enhanced Security in Acrobat Reader to sandbox PDF rendering.
• Apply the principle of least privilege to user accounts to limit the impact of code execution.
• Monitor Adobe security advisories for further updates or mitigations.

Detection

• Monitor for unusual child processes spawned by Acrobat Reader (e.g., cmd.exe, powershell.exe) that may indicate exploitation.
• Use endpoint detection to flag PDF files that trigger use-after-free patterns or abnormal memory operations in Acrobat Reader.
• Review file download and email gateway logs for PDFs with embedded AcroForm button actions from untrusted sources.
• Correlate Acrobat Reader crashes or hangs with subsequent suspicious process creation events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.