CVE-2021-28560

What it actually does

CVE-2021-28560 is a heap-based buffer overflow in Adobe Acrobat and Acrobat Reader. A specially crafted PDF can corrupt heap memory when parsed by an affected version, allowing an unauthenticated attacker to execute arbitrary code in the context of the user who opens the file. Because the code runs with the victim user's privileges, impact includes data theft, payload execution, persistence setup, and potential lateral movement if the user has access to sensitive resources. The vulnerability requires user interaction: the victim must open the malicious document.

Why it matters to the business

Successful exploitation can turn a routine PDF-opening action into workstation compromise. This can lead to malware installation, credential theft, unauthorized access to documents and email, and interruption of business operations. The CVSS score is high at 8.8, and the EPSS score is also high and stable at approximately 0.669, indicating meaningful exploitation likelihood even though it is not currently listed in CISA KEV and is not specifically marked as ransomware-associated. Because the affected software is widely deployed on Windows and macOS endpoints, unpatched installations represent a broad phishing-driven compromise risk.

How an attack unfolds

An attacker creates a malicious PDF designed to trigger the heap overflow in vulnerable Acrobat or Acrobat Reader versions. The attacker delivers the PDF through phishing email, a file-sharing link, a compromised website, or another document-distribution channel. When the victim opens the file, Acrobat or Reader parses the malformed content and corrupts heap memory. If exploitation succeeds, attacker-controlled code executes with the privileges of the current user. The payload may launch a child process, drop malware into user-writable directories, connect to command-and-control infrastructure, harvest credentials or documents, and attempt privilege escalation or lateral movement. Failed exploitation may appear as an Acrobat or Reader crash, often followed by repeated attempts or suspicious document-delivery activity.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to a current supported release. Systems running Acrobat Reader DC 2021.001.20150 or earlier, Acrobat/Reader 2020.001.30020 or earlier, or Acrobat/Reader 2017.011.30194 or earlier should be treated as vulnerable and updated immediately. Remove unsupported Acrobat/Reader branches where possible. If immediate patching is not possible, reduce exposure by enabling Protected Mode and Protected View, disabling unnecessary JavaScript in PDFs, blocking Acrobat/Reader from launching child processes where feasible, restricting PDF execution from temporary and email-cache locations, using application control, and increasing inspection of inbound PDF attachments. Ensure endpoint detection and response tools monitor Acrobat and Reader process behavior.

How to confirm the fix worked

Confirm installed Acrobat and Reader versions through centralized software inventory, endpoint management tools, vulnerability scanners, or the application About dialog. Validate that no endpoint remains on Acrobat Reader DC 2021.001.20150 or earlier, Acrobat/Reader 2020.001.30020 or earlier, or Acrobat/Reader 2017.011.30194 or earlier. On Windows, verify installed product and file versions for AcroRd32.exe and Acrobat.exe; on macOS, verify application bundle versions under /Applications. Run authenticated vulnerability scans after patching and confirm scanners no longer report the affected version ranges. Test policy mitigations by confirming Protected Mode or Protected View settings are enabled and that Acrobat/Reader child-process creation is blocked or alerted where that control is deployed.

Typical attack path

1. Attacker prepares a crafted PDF that triggers the heap-based buffer overflow in vulnerable Acrobat or Acrobat Reader versions.
2. Attacker sends the PDF to a target through phishing, file-sharing, web download, or another social-engineering channel.
3. Victim opens the malicious PDF in an affected Acrobat or Reader application.
4. The PDF parsing logic corrupts heap memory and diverts execution flow to attacker-controlled code.
5. Payload runs in the context of the current user and may spawn command shells, scripting engines, or downloader processes.
6. Attacker establishes persistence, steals data or credentials, and may use the compromised endpoint for further access.

How to detect it

Look for evidence of suspicious PDF handling followed by Acrobat or Reader crashes, child-process creation, payload drops, or network callbacks. Useful log sources include EDR process telemetry, Sysmon Event ID 1 process creation, Sysmon Event ID 3 network connections, Windows Security 4688 process creation, Windows Error Reporting application crash events, email security gateway logs, web proxy/download logs, DNS logs, and macOS Unified Logs. Hunt for AcroRd32.exe, Acrobat.exe, or Adobe Reader.app opening a recently delivered PDF and then spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl, osascript, sh, bash, or python. Review user-writable paths such as Downloads, Temp, AppData, /tmp, and ~/Library for newly dropped executables, scripts, launch agents, or persistence files created immediately after a PDF was opened. Investigate Acrobat/Reader crashes that occur near suspicious email delivery, attachment opening, or outbound connections from Acrobat/Reader processes. Because no public fixed IOC such as a hash or campaign domain is provided, prioritize behavior-based detection rather than static indicators.

• AcroRd32.exe
• Acrobat.exe
• Adobe Reader.app
• AcroRd32.exe cmd.exe
• AcroRd32.exe powershell.exe
• AcroRd32.exe wscript.exe
• AcroRd32.exe cscript.exe
• AcroRd32.exe mshta.exe
• AcroRd32.exe rundll32.exe
• AcroRd32.exe regsvr32.exe
• AcroRd32.exe certutil.exe
• Acrobat.exe cmd.exe
• Acrobat.exe powershell.exe
• Acrobat.exe wscript.exe
• Acrobat.exe cscript.exe
• Acrobat.exe mshta.exe
• Acrobat.exe rundll32.exe
• Acrobat.exe regsvr32.exe
• Acrobat.exe certutil.exe
• Faulting application name: AcroRd32.exe
• Faulting application name: Acrobat.exe
• /Applications/Adobe Acrobat Reader.app
• /Applications/Adobe Acrobat.app
• ~/Library/LaunchAgents/
• /tmp/
• %TEMP%
• %APPDATA%

What your security team should do

• Prioritize patching or removing affected Acrobat and Acrobat Reader installations because the vulnerability is high severity and has a high EPSS likelihood score.
• Inventory all Windows and macOS endpoints for Acrobat and Reader versions, including legacy 2017 and 2020 branches.
• Harden PDF handling by enabling Protected Mode, Protected View, and disabling unnecessary PDF JavaScript functionality.
• Create EDR/SIEM detections for Acrobat or Reader spawning command shells, scripting engines, archive tools, LOLBins, or network download utilities.
• Review email and web gateway telemetry for suspicious PDF delivery to users, especially around any Acrobat crash or suspicious child-process execution.
• Block or quarantine PDFs from untrusted sources where feasible, and apply attachment sandboxing for inbound email.
• Investigate any Acrobat or Reader crash followed by process creation, new persistence artifacts, credential-access behavior, or outbound network connections.
• Educate users to treat unexpected PDFs as potentially malicious and to report suspicious document behavior, crashes, or security prompts.