Back to KEVs

CVE-2021-21017

Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution

Basic Information

CVE State
PUBLISHED
Reserved Date
December 18, 2020
Published Date
February 11, 2021
Last Updated
February 04, 2025
Vendor
Adobe
Product
Acrobat Reader
Description
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS Scores

CVSS v3.1

8.8 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC Information

Exploitation
active
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (added 2021-11-03 00:00:00 UTC) Source
Proof of Concept Available
Yes (added 2021-02-26 14:18:13 UTC) Source

References

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Known Exploited Vulnerability Information

Source Added Date
CISA 2021-11-03 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

ZeusBox/CVE-2021-21017

Type: github • Created: 2021-02-26 14:18:13 UTC • Stars: 43