CVE-2021-28550
Adobe Acrobat and Reader Use-After-Free Vulnerability
Description
CVE-2021-28550 is a high-severity use-after-free vulnerability in Adobe Acrobat and Reader that allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a specially crafted malicious PDF document. CISA has confirmed active exploitation of this Adobe Acrobat vulnerability by adding it to the Known Exploited Vulnerabilities catalog. With an EPSS score of 32.05% (96.8th percentile), CVE-2021-28550 poses a significant and ongoing exploitation risk to organizations running unpatched versions of Adobe Acrobat and Reader.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat dc | >= 15.008.20082, <= 21.001.20150; >= 15.008.20082, <= 21.001.20149 |
| adobe | acrobat reader dc | >= 15.008.20082, <= 21.001.20150; >= 15.008.20082, <= 21.001.20149 |
| adobe | acrobat | >= 17.011.30059, <= 17.011.30194; >= 20.001.30005, <= 20.001.30020 |
| adobe | acrobat reader | >= 17.011.30059, <= 17.011.30194; >= 20.001.30005, <= 20.001.30020 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://helpx.adobe.com/security/products/acrobat/apsb21-29.html(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28550(Third Party Advisory, US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free is a vulnerability that occurs when software continues to use a pointer after the memory it references has been freed, potentially leading to data corruption, information disclosure, or code execution. In Adobe Acrobat and Reader, this manifests when the application dereferences freed memory during PDF processing, allowing an attacker to control what occupies that memory and hijack execution flow.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-28550 carries a CVSS 3.1 score of 8.8 (HIGH), representing a serious threat to organizations with deployed Adobe Acrobat and Reader installations. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed to open a malicious PDF file. Successful exploitation leads to high impact across confidentiality, integrity, and availability, granting the attacker arbitrary code execution with the privileges of the current user. The EPSS score of 32.05% (96.8th percentile) indicates that this vulnerability is among the top tier for exploitation likelihood, suggesting widespread attacker interest and likely incorporation into exploit kits. Given the ubiquity of Adobe Acrobat and Reader in enterprise environments and the ease of delivering malicious PDFs via email, this vulnerability presents a substantial attack surface for targeted and opportunistic campaigns.
Exploit Maturity
CVE-2021-28550 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 32.05% (96.8th percentile) indicates a high probability of exploitation activity. Adobe's secondary CVSS assessment rated this vulnerability at 9.6 (CRITICAL) with a changed scope, suggesting that exploitation could impact resources beyond the vulnerable component itself. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive. The confirmed active exploitation and high EPSS percentile indicate that reliable exploitation techniques are available and being actively used by threat actors.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update to versions newer than Acrobat DC/Reader DC 2021.001.20150, Acrobat 2020/Reader 2020 past 2020.001.30020, and Acrobat 2017/Reader 2017 past 2017.011.30194.
- Conduct a comprehensive inventory of all Adobe Acrobat and Reader installations across the organization, including both Windows and macOS deployments. Ensure all product tracks (DC Continuous, 2020 Classic, 2017 Classic) are updated to patched versions.
- Enable Protected Mode and Enhanced Security settings in Adobe Acrobat and Reader. Restrict JavaScript execution within PDF documents and disable features that allow embedded file operations from untrusted content.
- Deploy endpoint detection and response (EDR) solutions to monitor for indicators of use-after-free exploitation, such as Adobe Acrobat or Reader processes exhibiting unusual memory allocation patterns, spawning unexpected child processes, or making anomalous network connections.
- Implement email security controls to sandbox and analyze PDF attachments before delivery. Configure web proxies to scan downloaded PDF files, and establish policies requiring PDF documents from external sources to be opened in isolated environments.
Technical Details
CVE-2021-28550 is a use-after-free vulnerability affecting Adobe Acrobat Reader DC versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier. The vulnerability is classified as CWE-416 (Use After Free), where the application dereferences a pointer to heap memory that has already been freed during PDF document processing. An attacker can manipulate heap layout through carefully crafted PDF content so that attacker-controlled data occupies the freed memory region when the dangling pointer is subsequently used. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms network-based delivery with low complexity and no privilege requirements, though user interaction is needed. Adobe's own assessment assigned a higher CVSS score of 9.6 with a changed scope (S:C), indicating the potential for exploitation to affect resources beyond the Acrobat Reader process itself.
Frequently Asked Questions
Is CVE-2021-28550 being actively exploited?
Yes. CVE-2021-28550 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 32.05% (96.8th percentile) further indicates a high probability of exploitation activity. Organizations should treat this as a high-priority patching item.
What products are affected by CVE-2021-28550?
CVE-2021-28550 affects multiple Adobe Acrobat and Reader product tracks. Specifically: Adobe Acrobat DC and Reader DC versions up to 2021.001.20150, Adobe Acrobat 2020 and Reader 2020 versions up to 2020.001.30020, and Adobe Acrobat 2017 and Reader 2017 versions up to 2017.011.30194. Both Windows and macOS platforms are affected.
How do I fix CVE-2021-28550?
Apply the security updates from Adobe Security Bulletin APSB21-29. Update all Adobe Acrobat and Reader installations to the latest available versions for each product track. Enable Protected Mode and Enhanced Security, and implement email filtering controls for PDF attachments.
How severe is CVE-2021-28550?
CVE-2021-28550 has a CVSS 3.1 score of 8.8 (HIGH) from NVD, while Adobe's own assessment rated it at 9.6 (CRITICAL). With an EPSS score at the 96.8th percentile and confirmed active exploitation, this is a critical-priority vulnerability requiring immediate attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.