Adobe · Acrobat and Reader
CVE-2021-28550
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
概要
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CISA: Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
対処法
Apply updates per vendor instructions.
米国連邦機関の対応期限：2021年11月17日
Adobeのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/05/20 | Heap-Based Buffer Overflow | Acrobat and Reader | 高 8.8 | 87% |
| 2026/04/13 | Prototype Pollution | Acrobat and Reader | 高 8.6 | 7.3% |
| 2023/10/10 | Use-After-Free | Acrobat and Reader | 高 7.8 | 59% |
| 2023/09/14 | Out-of-Bounds Write | Acrobat and Reader | 高 7.8 | 7.5% |
| 2022/06/08 | Buffer Overflow | Acrobat and Reader | 高 7.8 | 87% |
| 2022/06/08 | Unspecified | Acrobat and Reader | 高 8.8 | 38% |
| 2022/06/08 | Universal 3D Remote Code Execution | Acrobat and Reader | 高 8.8 | 83% |
| 2022/06/08 | Use-After-Free | Acrobat and Reader | 高 7.8 | 82% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。