CVE-2021-28550

What it actually does

CVE-2021-28550 is a use-after-free vulnerability in Adobe Acrobat and Acrobat Reader DC. A specially crafted PDF can trigger unsafe reuse of freed memory and allow attacker-controlled code execution in the context of the user who opens the document. Because exploitation runs with the victim user’s privileges, impact can include file access, credential theft, malware installation, persistence setup, and lateral movement if the user has access to sensitive systems or shared resources. The vulnerability affects Acrobat/Reader DC versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier on Windows and macOS.

Why it matters to the business

Successful exploitation can turn a malicious PDF into an initial access vector, allowing an attacker to compromise workstations through phishing or document delivery. This can lead to data theft, business email compromise, malware deployment, and operational disruption. The vulnerability is listed in CISA KEV with a required remediation date of 2021-11-17 and has active in-the-wild exploitation, so unpatched systems should be treated as high-priority exposure even though user interaction is required. Its long public exposure window and high EPSS score indicate meaningful exploitation likelihood in environments where Acrobat or Reader remains outdated.

How an attack unfolds

An attacker prepares a malicious PDF that abuses the Acrobat/Reader memory corruption condition. The file is delivered to a target through email, web download, messaging, or another document-sharing channel. When the victim opens the PDF in a vulnerable version of Acrobat or Reader, the use-after-free condition is triggered and attacker-controlled shellcode or embedded exploit logic executes under the victim’s user account. The exploit commonly attempts to launch a payload, drop files, connect to attacker-controlled infrastructure, or run living-off-the-land tools such as PowerShell, cmd.exe, mshta, rundll32, or certutil. After code execution, the attacker may establish persistence, harvest credentials or documents, move laterally using the user’s access, or deploy additional malware. Exploitation has been observed in the wild and is tracked by CISA KEV, so document-based intrusion activity involving Acrobat/Reader should be investigated aggressively.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to a fully supported, current version. At minimum, ensure installed versions are newer than the affected releases: Acrobat/Reader DC 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier. Where enterprise patch management is used, deploy the relevant Adobe security update across Windows and macOS endpoints and verify successful installation. Remove unsupported Acrobat/Reader branches where possible. As mitigations, restrict opening of PDFs from untrusted sources, disable unnecessary JavaScript in Acrobat/Reader, enable Protected View and sandboxing features, enforce least privilege, block Acrobat/Reader from spawning scripting and command interpreters where operationally feasible, and use email/web filtering to detonate or quarantine suspicious PDFs. Systems that cannot be patched should be isolated or prevented from opening externally sourced PDFs until remediated.

How to confirm the fix worked

Confirm installed Acrobat/Reader versions through software inventory, endpoint management, package managers, or local application version checks, and verify they are newer than the vulnerable version thresholds. On Windows, inspect installed Adobe Acrobat/Reader product versions from Add/Remove Programs, endpoint inventory, or file metadata for AcroRd32.exe and Acrobat.exe. On macOS, verify the application version in the Adobe Acrobat/Reader app bundle metadata or management inventory. Validate that Adobe automatic updates or enterprise patch deployment completed successfully and did not leave older parallel installations. Test hardening controls by confirming Acrobat/Reader cannot spawn blocked child processes such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, regsvr32.exe, or certutil.exe unless explicitly required. Review email and web gateways to ensure external PDFs are scanned or sandboxed before delivery.

Typical attack path

1. Attacker identifies organizations or users likely to open PDF attachments or downloaded documents.
2. Attacker crafts or obtains a malicious PDF designed to trigger the Acrobat/Reader use-after-free vulnerability.
3. Attacker delivers the PDF through phishing email, compromised websites, file-sharing links, or messaging platforms.
4. Victim opens the PDF using a vulnerable Acrobat or Acrobat Reader version.
5. The malformed PDF triggers memory corruption and executes attacker-controlled code as the current user.
6. Exploit code drops or launches a second-stage payload, often using system utilities such as PowerShell, cmd.exe, mshta, rundll32, regsvr32, or certutil.
7. Attacker establishes command-and-control, persistence, credential access, or document theft.
8. Attacker expands access using the compromised user’s privileges and available network resources.

How to detect it

Look for evidence that Acrobat or Reader opened a suspicious PDF and then spawned unexpected processes, wrote executable content, or initiated outbound network activity. Primary sources include EDR process telemetry, Windows Security logs with process creation enabled, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Sysmon Event ID 3 network connections, macOS endpoint telemetry, email gateway attachment logs, web proxy download logs, Adobe crash reports, and sandbox detonation results. Investigate Acrobat.exe, AcroRd32.exe, or related Adobe Reader processes launching command interpreters, scripting engines, LOLBins, or newly dropped executables. Correlate suspicious PDF delivery times with endpoint events, crashes, child process creation, file writes to user-writable paths, and outbound connections to uncategorized or newly registered domains. Review for persistence created shortly after PDF execution, including Run keys, Startup folder entries, LaunchAgents, scheduled tasks, or login items. Because exploit artifacts vary by campaign, prioritize behavioral evidence rather than relying only on static file hashes.

• AcroRd32.exe -> cmd.exe
• AcroRd32.exe -> powershell.exe
• AcroRd32.exe -> wscript.exe
• AcroRd32.exe -> cscript.exe
• AcroRd32.exe -> mshta.exe
• AcroRd32.exe -> rundll32.exe
• AcroRd32.exe -> regsvr32.exe
• AcroRd32.exe -> certutil.exe
• AcroRd32.exe -> bitsadmin.exe
• Acrobat.exe -> cmd.exe
• Acrobat.exe -> powershell.exe
• Acrobat.exe -> wscript.exe
• Acrobat.exe -> cscript.exe
• Acrobat.exe -> mshta.exe
• Acrobat.exe -> rundll32.exe
• Acrobat.exe -> regsvr32.exe
• Acrobat.exe -> certutil.exe
• Acrobat.exe -> bitsadmin.exe
• ParentImage=AcroRd32.exe Image=powershell.exe
• ParentImage=AcroRd32.exe Image=cmd.exe
• ParentImage=Acrobat.exe Image=powershell.exe
• ParentImage=Acrobat.exe Image=cmd.exe
• ParentImage=AcroRd32.exe Image=mshta.exe
• ParentImage=Acrobat.exe Image=mshta.exe
• ParentImage=AcroRd32.exe Image=rundll32.exe
• ParentImage=Acrobat.exe Image=rundll32.exe
• ParentImage=AcroRd32.exe Image=regsvr32.exe
• ParentImage=Acrobat.exe Image=regsvr32.exe
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• %TEMP%\*.exe
• %APPDATA%\*.exe
• %LOCALAPPDATA%\Temp\*.exe
• /Library/LaunchAgents/
• ~/Library/LaunchAgents/
• com.adobe.Reader.plist
• AcroRd32.exe
• Acrobat.exe
• RdrCEF.exe

What your security team should do

• Immediately inventory Adobe Acrobat and Acrobat Reader installations across Windows and macOS endpoints and prioritize any versions at or below 2021.001.20150, 2020.001.30020, or 2017.011.30194.
• Patch or upgrade all affected installations to the latest supported Adobe release; treat remediation as urgent because the vulnerability is in CISA KEV and has active in-the-wild exploitation.
• Hunt for suspicious Acrobat/Reader activity from the period before patching, especially PDF opens followed by script interpreters, command shells, archive tools, network utilities, or unknown executables.
• Add EDR/SIEM detections for Acrobat.exe or AcroRd32.exe spawning powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, or unknown binaries.
• Review email gateway, web proxy, and file sandbox logs for suspicious PDFs delivered to users, especially attachments followed by endpoint alerts or unusual network connections.
• Enable or enforce Acrobat/Reader Protected View, sandboxing, and JavaScript restrictions where compatible with business workflows.
• Block or alert on Office/PDF reader applications creating executables in user-writable directories such as Downloads, AppData, Temp, or Public.
• If exploitation is suspected, isolate the endpoint, preserve the malicious PDF and memory/EDR telemetry, collect process trees and network connections, and reset credentials for the affected user if theft is plausible.