Actively exploited · Published Sep 2, 2021 · Assigned by adobe
CVE-2021-28550Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
Critical 9.6 Exploited
In plain English
A critical-severity use-after-free in Acrobat Reader from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 52.1% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | tor | 0.4.6.5-r0 | ALPINE-CVE-2021-28550 |
| Alpine:v3.21 | tor | 0.4.6.5-r0 | ALPINE-CVE-2021-28550 |
| Alpine:v3.22 | tor | 0.4.6.5-r0 | ALPINE-CVE-2021-28550 |
| Alpine:v3.23 | tor | 0.4.6.5-r0 | ALPINE-CVE-2021-28550 |
| Alpine:v3.24 | tor | 0.4.6.5-r0 | ALPINE-CVE-2021-28550 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Acrobat Reader | unspecified – through 2020.001.30020unspecified – through 2021.001.20150unspecified – through 2017.011.30194unspecified – through None |
Weakness: CWE-416 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H