Vulnerability record · CVE-2021-44703 · published 14 January 2022
CVE-2021-44703: Adobe Acrobat Reader DC stack buffer overflow via crafted file
Adobe · Acrobat Dc
Acrobat Reader DC 21.007.20099 and earlier, 20.004.30017 and earlier, and 17.011.30204 and earlier mishandle a crafted file, causing a stack-based buffer overflow (CWE-121/CWE-787). A victim must open the malicious file, after which the overflow can lead to arbitrary code execution as the current user.
Description
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.8 with full code execution impact and a very high EPSS percentile, though exploitation requires user interaction and no KEV listing or public exploit is recorded.
What it is
Acrobat Reader DC 21.007.20099 and earlier, 20.004.30017 and earlier, and 17.011.30204 and earlier mishandle a crafted file, causing a stack-based buffer overflow (CWE-121/CWE-787). A victim must open the malicious file, after which the overflow can lead to arbitrary code execution as the current user.
Impact
An attacker who gets a victim to open a crafted file can execute arbitrary code in the context of that user, giving full control of confidentiality, integrity and availability for the process.
Attack surface
Reached locally by opening a malicious file in the affected Acrobat Reader DC or Acrobat products; no privileges are required but user interaction (opening the file) is required per the CVSS vector AV:L/UI:R.
Exploitation
Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, but EPSS is 0.573 (99th percentile), indicating elevated predicted likelihood of exploitation.
What to do
- Update Acrobat Reader DC and Acrobat to the fixed versions in Adobe advisory APSB22-01 (21.007.20099, 20.004.30017 and 17.011.30204 are the last affected builds).
- Where patching is delayed, restrict or block opening untrusted PDFs and other crafted files from email, web downloads and removable media.
- Enable Protected View/Protected Mode and other sandboxing so a successful overflow is contained.
- Remove or disable the affected legacy product branches (20.x and 17.x) where they are no longer needed.
Detection
- Monitor for Acrobat Reader/Acrobat processes spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for a PDF viewer.
- Hunt for crashes or abnormal termination of Acrobat processes correlated with recently opened files from email or download directories.
- Alert on PDFs or other files written to temp or user directories immediately before Acrobat process creation.
- Review endpoint telemetry for memory-corruption indicators in Acrobat modules and for file writes to startup or persistence locations following document open.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat/apsb22-01.html | Vendor Advisory |
| https://helpx.adobe.com/security/products/acrobat/apsb22-01.html | Vendor Advisory |
Track CVE-2021-44703 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-44703), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
