Actively exploited · Published Feb 11, 2021 · Assigned by adobe
CVE-2021-21017Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution
High 8.8 Exploited
In plain English
A high-severity heap buffer overflow in Acrobat Reader from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 86.3% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Acrobat Reader | unspecified – through 2020.013.20074unspecified – through 2020.001.30018unspecified – through 2017.011.30188unspecified – through None |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H