Adobe · Acrobat and Reader
CVE-2021-28550
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
무엇인가
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CISA: Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2021년 11월 17일
Adobe의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 5. 20. | Heap-Based Buffer Overflow | Acrobat and Reader | 높음 8.8 | 87% |
| 2026. 4. 13. | Prototype Pollution | Acrobat and Reader | 높음 8.6 | 7.2% |
| 2023. 10. 10. | Use-After-Free | Acrobat and Reader | 높음 7.8 | 59% |
| 2023. 9. 14. | Out-of-Bounds Write | Acrobat and Reader | 높음 7.8 | 6.7% |
| 2022. 6. 8. | Buffer Overflow | Acrobat and Reader | 높음 7.8 | 87% |
| 2022. 6. 8. | Unspecified | Acrobat and Reader | 높음 8.8 | 38% |
| 2022. 6. 8. | Universal 3D Remote Code Execution | Acrobat and Reader | 높음 8.8 | 83% |
| 2022. 6. 8. | Use-After-Free | Acrobat and Reader | 높음 7.8 | 82% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.