Vulnerability · Published Sep 27, 2021 · Assigned by adobe
CVE-2021-39826Adobe Digital Editions Command Execution Vulnerability
High 8.6
In plain English
A high-severity OS command injection in Digital Editions from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)2.1%top 18.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary command execution vulnerability. An authenticated attacker could leverage this vulnerability to execute arbitrary commands. User interaction is required to abuse this vulnerability in that a user must open a maliciously crafted .epub file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Digital Editions | unspecified – through 4.5.11.187646unspecified – through None |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H