CVE-2021-40728: Adobe Acrobat Reader use-after-free in GetURL window object

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.8 with high EPSS and a code-execution impact in a ubiquitous client make this a high-priority patch despite no KEV listing.

What it is

Adobe Acrobat Reader DC (versions 21.007.20095, 21.007.20096, 20.004.30015, 17.011.30202 and earlier) contains a use-after-free flaw in the processing of the GetURL function on the global window object. Successful exploitation can lead to arbitrary code execution in the context of the current user, making it a serious client-side risk for anyone opening untrusted PDFs.

Impact

An attacker can execute arbitrary code with the privileges of the user running Acrobat Reader, potentially leading to full system compromise. Because the flaw is in a widely deployed document reader, a single malicious file can hand over the victim's session.

Attack surface

The vulnerability is reached locally when a victim opens a crafted file in Acrobat Reader; the CVSS vector shows AV:L, PR:N and UI:R, so no authentication is needed but user interaction (opening the malicious document) is required. There is no indication of a remote, unauthenticated network vector in the record.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit references, but EPSS is high at 0.54627 (99th percentile), indicating elevated likelihood of exploitation activity. No ransomware association is documented.

What to do

• Update Acrobat Reader DC and Acrobat DC to the fixed versions referenced in Adobe security bulletin APSB21-104.
• Where immediate patching is not possible, restrict or disable JavaScript and the GetURL/launch functionality in Acrobat Reader via the registry or preferences.
• Enable Protected View/Protected Mode and Enhanced Security in Acrobat Reader to sandbox document processing.
• Block or quarantine untrusted PDF attachments at the email and web gateway, and train users not to open unexpected documents.
• Consider application allowlisting or endpoint controls that prevent Acrobat Reader from spawning unexpected child processes.

Detection

• Monitor for Acrobat Reader processes spawning cmd.exe, powershell.exe, wscript.exe, or other unexpected child processes.
• Hunt for PDF files containing GetURL or embedded JavaScript that reference external URLs or launch actions, especially from email or download directories.
• Review endpoint telemetry for Acrobat Reader crashes or memory corruption events that may indicate exploitation attempts.
• Correlate Acrobat Reader execution with outbound network connections to unusual destinations shortly after a document is opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.