CVE-2021-21017

What it actually does

CVE-2021-21017 is a heap-based buffer overflow in Adobe Acrobat and Acrobat Reader DC on Windows and macOS. A crafted PDF or other supported document can corrupt heap memory during parsing and allow an unauthenticated attacker to execute arbitrary code in the context of the user who opens the file. Because execution occurs as the current user, impact depends on that user's privileges, but successful exploitation can allow data theft, malware installation, persistence, and further compromise.

Why it matters to the business

This vulnerability affects widely deployed PDF software and has documented in-the-wild exploitation, a high EPSS score, and CISA KEV listing with a past remediation deadline of 2021-11-17. Organizations with unpatched Acrobat or Reader installations face realistic risk from phishing, malicious downloads, and weaponized documents that can compromise user workstations, disrupt operations, expose sensitive data, and provide an initial foothold for broader intrusion activity.

How an attack unfolds

An attacker typically delivers a malicious PDF through email, a file-sharing link, a compromised website, or another social-engineering channel. When a user opens the file in a vulnerable version of Adobe Acrobat or Acrobat Reader DC, the application parses malformed content that triggers heap memory corruption. The exploit then redirects execution flow to attacker-controlled code, commonly using techniques such as heap grooming and return-oriented programming to bypass platform protections. The payload runs with the privileges of the current user and may download additional malware, steal files or credentials accessible to that user, establish persistence, or hand off execution to post-exploitation tooling. Exploitation requires user interaction, but the vulnerability is known to have been actively exploited in the wild, making malicious document delivery a credible attack path.

How to fix it

Upgrade Adobe Acrobat and Acrobat Reader DC to a vendor-supported version newer than the affected releases: 2020.013.20074 and earlier, 2020.001.30018 and earlier, and 2017.011.30188 and earlier. Where exact fixed package versions are not centrally tracked, install the latest available Adobe security update for Acrobat/Reader and verify the installed build is no longer within the vulnerable ranges. Remove unsupported 2017-era branches where possible. Enable automatic updates for Adobe products, restrict use of legacy PDF readers, and prioritize internet-facing, email-heavy, and high-risk user workstations. As interim mitigations, use Protected View/sandboxing, limit JavaScript and embedded content in PDFs where operationally feasible, block high-risk attachment types and untrusted PDF delivery paths, and ensure endpoint protection monitors Acrobat/Reader child-process activity.

How to confirm the fix worked

Confirm exposure by inventorying installed Adobe Acrobat and Acrobat Reader versions across Windows and macOS endpoints and comparing them against the affected version ranges. On Windows, validate product versions through installed software inventory, Adobe update records, executable file versions, and endpoint management tooling. On macOS, validate installed application versions in application inventory or package receipts. Confirm that no endpoints remain on Acrobat/Reader DC 2020.013.20074 or earlier, 2020.001.30018 or earlier, or 2017.011.30188 or earlier. Validate that automatic update policies are enabled and that endpoint controls are generating telemetry for Acrobat/Reader process creation, child processes, crashes, and network activity. If compensating controls are used, test that untrusted PDFs open in Protected View or equivalent sandboxing and that suspicious Acrobat-launched processes are blocked or alerted.

Typical attack path

1. Attacker identifies users likely to open PDF attachments or links.
2. Attacker crafts or obtains a malicious document that triggers the heap-based buffer overflow in vulnerable Acrobat or Reader versions.
3. Attacker delivers the file through phishing, web download, file-sharing services, or a compromised site.
4. Victim opens the malicious file using an affected Acrobat or Reader installation.
5. The vulnerable parser corrupts heap memory and transfers execution to attacker-controlled code.
6. Payload executes in the current user's security context.
7. Attacker downloads second-stage malware, steals accessible data, establishes persistence, or attempts privilege escalation and lateral movement.

How to detect it

To determine whether exploitation already occurred, review endpoint, email, proxy, and EDR telemetry for suspicious activity following PDF opens in vulnerable Acrobat or Reader versions. Key sources include Windows Security Event ID 4688 process creation logs, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Sysmon Event ID 22 DNS queries, EDR process trees, application crash logs, Windows Error Reporting, macOS Unified Logs, email gateway attachment logs, web proxy download logs, and file quarantine records. Look for Acrobat or Reader processes opening externally delivered PDFs, crashing unexpectedly, then spawning command shells, scripting engines, download utilities, rundll32/regsvr32/mshta, or making unusual outbound connections. Investigate newly written executables, scripts, scheduled tasks, Run keys, LaunchAgents, credential-access tooling, or beaconing activity created shortly after a PDF was opened. There are no universally reliable file hashes or network indicators for this vulnerability because exploit documents and payloads vary by campaign, so behavioral detection is more reliable than static IOC matching.

• AcroRd32.exe spawning cmd.exe
• AcroRd32.exe spawning powershell.exe
• AcroRd32.exe spawning wscript.exe
• AcroRd32.exe spawning cscript.exe
• AcroRd32.exe spawning mshta.exe
• AcroRd32.exe spawning rundll32.exe
• AcroRd32.exe spawning regsvr32.exe
• AcroRd32.exe spawning certutil.exe
• AcroRd32.exe spawning bitsadmin.exe
• AcroRd32.exe spawning curl.exe
• AcroRd32.exe spawning wget.exe
• Acrobat.exe spawning cmd.exe
• Acrobat.exe spawning powershell.exe
• Acrobat.exe spawning wscript.exe
• Acrobat.exe spawning cscript.exe
• Acrobat.exe spawning mshta.exe
• Acrobat.exe spawning rundll32.exe
• Acrobat.exe spawning regsvr32.exe
• Acrobat.exe spawning certutil.exe
• Acrobat.exe spawning bitsadmin.exe
• Acrobat.exe spawning curl.exe
• Acrobat.exe spawning wget.exe
• ParentImage=*\\AcroRd32.exe Image=*\\cmd.exe
• ParentImage=*\\AcroRd32.exe Image=*\\powershell.exe
• ParentImage=*\\AcroRd32.exe Image=*\\mshta.exe
• ParentImage=*\\AcroRd32.exe Image=*\\rundll32.exe
• ParentImage=*\\Acrobat.exe Image=*\\cmd.exe
• ParentImage=*\\Acrobat.exe Image=*\\powershell.exe
• ParentImage=*\\Acrobat.exe Image=*\\mshta.exe
• ParentImage=*\\Acrobat.exe Image=*\\rundll32.exe
• Faulting application name: AcroRd32.exe
• Faulting application name: Acrobat.exe
• /Applications/Adobe Acrobat Reader.app
• /Applications/Adobe Acrobat DC/Adobe Acrobat.app
• com.adobe.Reader

What your security team should do

• Treat this as high priority because it is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score.
• Immediately inventory Acrobat and Reader installations and upgrade all vulnerable versions to the latest supported Adobe release.
• Prioritize systems used for email, web browsing, document handling, finance, legal, HR, and other roles likely to receive external PDFs.
• Hunt for historical Acrobat/Reader exploitation using EDR, process creation, crash, email gateway, proxy, and file-write telemetry around the time users opened external PDF files.
• Create or tune detections for Acrobat/Reader spawning command interpreters, scripting engines, LOLBins, archive tools, download utilities, or unexpected network connections.
• Block or quarantine suspicious PDF attachments from external senders, especially those followed by Acrobat crashes or child-process execution.
• Remove unsupported Acrobat/Reader branches and enforce automatic updates through endpoint management.
• Review compromised-document cases for follow-on activity such as credential theft, persistence, privilege escalation, and lateral movement rather than limiting the investigation to the PDF file itself.