Adobe · Acrobat and Reader
CVE-2021-28550
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
What it is
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CISA: Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 17, 2021
- Added to the CISA list
- November 3, 2021
- Published
- September 2, 2021
- Severity
- Critical 9.6 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 52% in the top 1.1% of all known vulnerabilities
- Weakness
- CWE-416
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
| Oct 10, 2023 | Use-After-Free | Acrobat and Reader | High 7.8 | 59% |
| Sep 14, 2023 | Out-of-Bounds Write | Acrobat and Reader | High 7.8 | 6.7% |
| Jun 8, 2022 | Buffer Overflow | Acrobat and Reader | High 7.8 | 87% |
| Jun 8, 2022 | Unspecified | Acrobat and Reader | High 8.8 | 38% |
| Jun 8, 2022 | Universal 3D Remote Code Execution | Acrobat and Reader | High 8.8 | 83% |
| Jun 8, 2022 | Use-After-Free | Acrobat and Reader | High 7.8 | 82% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.