CVE-2021-39840: Adobe Acrobat Reader use-after-free in AcroForms processing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh CVSS (7.8) with high EPSS and arbitrary code execution impact, though exploitation requires user interaction and no KEV listing.

What it is

Adobe Acrobat Reader DC (2021.005.20060, 2020.004.30006, 2017.011.30199 and earlier) contains a use-after-free flaw when processing AcroForms. Successful exploitation can lead to arbitrary code execution in the context of the current user, making it a serious client-side risk for anyone opening untrusted PDFs.

Impact

An attacker can execute arbitrary code with the privileges of the user running Acrobat Reader, potentially leading to full system compromise. The CVSS vector shows high confidentiality, integrity and availability impact.

Attack surface

The vulnerability is reached locally (AV:L) with no privileges required (PR:N), but requires user interaction (UI:R) — the victim must open a malicious PDF or visit a malicious page. No authentication is needed.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.50626 (98.8th percentile), indicating a high likelihood of exploitation activity. The only references are Adobe's vendor advisory and release notes, with no public exploit tags.

What to do

• Apply the Adobe security update referenced in APSB21-55 immediately.
• Upgrade to the latest supported Acrobat Reader DC version and remove or isolate end-of-life versions (2017, 2020 tracks).
• Disable JavaScript in Acrobat Reader where feasible and enable Protected View/Protected Mode.
• Block untrusted PDFs at email and web gateways, and train users not to open unexpected attachments.
• Consider application allowlisting or sandboxing for PDF readers on high-risk endpoints.

Detection

• Monitor for Acrobat Reader processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Hunt for unusual file writes or registry modifications originating from AcroRd32.exe or Acrobat.exe.
• Inspect PDFs for embedded JavaScript or AcroForm objects that trigger heap manipulation, using sandbox detonation.
• Correlate endpoint alerts for use-after-free exploitation patterns (crash followed by code execution) in Acrobat Reader.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.