CVE-2021-28635

What it actually does

CVE-2021-28635 is a use-after-free memory corruption vulnerability in Adobe Acrobat DC and Adobe Acrobat Reader DC. A crafted PDF can cause the application to access freed memory and redirect execution flow, allowing an unauthenticated attacker to run arbitrary code with the privileges of the user who opened the file. The vulnerability requires user interaction, but no prior authentication or elevated privileges. Successful exploitation can provide full read/write/execute capability within the current user context, enabling data theft, malware installation, lateral movement preparation, or privilege escalation through additional techniques.

Why it matters to the business

A successful attack can turn a routine document-open action into workstation compromise. Organizations using affected Acrobat or Reader versions could see credential theft, unauthorized access to sensitive documents, malware deployment, or disruption of user endpoints. Because PDF files are common in email, web downloads, legal/finance workflows, and third-party document exchange, the exposure is operationally broad even though exploitation requires a user to open a malicious file. This issue is not currently listed in CISA KEV and has no ransomware-specific KEV flag, but its EPSS score is relatively high and stable, indicating meaningful exploitation likelihood compared with many vulnerabilities.

How an attack unfolds

An attacker creates a malicious PDF designed to trigger the use-after-free condition in a vulnerable Adobe Acrobat or Reader version. The attacker delivers the file through phishing email, a compromised website, file-sharing service, instant messaging, or another document exchange channel. When the victim opens the PDF, Acrobat or Reader mishandles freed memory, allowing attacker-controlled data to influence program execution. A working exploit typically uses memory-layout manipulation and code-reuse or shellcode techniques to bypass common protections, then runs a payload in the context of the logged-in user. From there, the attacker may download additional malware, steal local files or browser/session data, establish persistence, or use harvested credentials for follow-on activity.

How to fix it

Upgrade Adobe Acrobat DC and Adobe Acrobat Reader DC to a vendor-supported version newer than the affected releases: Acrobat/Reader DC 2021.005.20054 and earlier, 2020.004.30005 and earlier, and 2017.011.30197 and earlier are affected. Because exact fixed versions were not provided in the input, apply the latest available Adobe security update for the installed release track or migrate to the current continuous track. Remove unsupported Acrobat/Reader versions where possible. Enable automatic Adobe updates, enforce Protected Mode/Protected View where operationally feasible, and restrict PDF execution behavior through application control, attachment sandboxing, and email/web filtering. If immediate patching is not possible, prioritize mitigations that reduce malicious document delivery and execution: block high-risk attachments from untrusted sources, detonate PDFs in a sandbox, prevent Acrobat/Reader from spawning script interpreters or command shells, and run users without local administrator privileges.

How to confirm the fix worked

Confirm exposure by inventorying installed Adobe Acrobat and Acrobat Reader versions across endpoints and comparing them against the affected version thresholds. On Windows, validate file/product versions for Acrobat.exe and AcroRd32.exe, confirm Adobe update status, and verify that the installed build is newer than the affected release line. Use vulnerability scanners, software inventory tools, endpoint management platforms, or Adobe Remote Update Manager where applicable. Confirm that Protected Mode/Protected View and auto-update settings are enabled if used as compensating controls. Validate detections by reviewing whether Acrobat/Reader process executions are blocked or alerted when spawning child interpreters such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, or regsvr32.exe. After patching, rescan endpoints and verify that no affected versions remain installed, including inactive or legacy Acrobat installations.

Typical attack path

1. Identify organizations or users likely to open external PDF documents.
2. Craft or obtain a malicious PDF that triggers the Acrobat/Reader use-after-free vulnerability.
3. Deliver the PDF through phishing, web download, file share, or another user-facing channel.
4. Convince the victim to open the file in a vulnerable Adobe Acrobat DC or Acrobat Reader DC version.
5. Exploit memory corruption to execute code as the current user.
6. Drop or download a second-stage payload, script, or remote access tool.
7. Perform post-exploitation actions such as credential theft, data collection, persistence, or lateral movement preparation.

How to detect it

Look for evidence of malicious PDF delivery followed by abnormal Acrobat or Reader behavior. Relevant sources include EDR telemetry, Windows Security Event ID 4688 process creation logs, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Sysmon Event ID 3 network connections, application crash logs, email gateway logs, web proxy logs, attachment sandbox results, and file quarantine events. Hunt for AcroRd32.exe or Acrobat.exe spawning command shells, scripting engines, Microsoft Office processes, rundll32/regsvr32/mshta, archive tools, or network utilities. Also look for Acrobat/Reader crashes followed by new executable/script creation in user-writable directories such as Downloads, Desktop, AppData, Temp, or ProgramData. Correlate suspicious PDF attachments or downloads with subsequent child process execution, outbound connections, credential access behavior, persistence creation, or AV/EDR alerts. Since no public CVE-specific file hash, domain, or malware family is provided, detection should focus on exploit behavior and post-exploitation artifacts rather than a single static indicator.

• AcroRd32.exe -> cmd.exe
• Acrobat.exe -> cmd.exe
• AcroRd32.exe -> powershell.exe
• Acrobat.exe -> powershell.exe
• AcroRd32.exe -> wscript.exe
• Acrobat.exe -> wscript.exe
• AcroRd32.exe -> cscript.exe
• Acrobat.exe -> cscript.exe
• AcroRd32.exe -> mshta.exe
• Acrobat.exe -> mshta.exe
• AcroRd32.exe -> rundll32.exe
• Acrobat.exe -> rundll32.exe
• AcroRd32.exe -> regsvr32.exe
• Acrobat.exe -> regsvr32.exe
• AcroRd32.exe -> certutil.exe
• Acrobat.exe -> certutil.exe
• AcroRd32.exe -> bitsadmin.exe
• Acrobat.exe -> bitsadmin.exe
• AcroRd32.exe -> curl.exe
• Acrobat.exe -> curl.exe
• AcroRd32.exe -> wget.exe
• Acrobat.exe -> wget.exe
• AcroRd32.exe -> schtasks.exe
• Acrobat.exe -> schtasks.exe
• AcroRd32.exe -> reg.exe
• Acrobat.exe -> reg.exe
• C:\Users\*\AppData\Local\Temp\*.exe
• C:\Users\*\AppData\Local\Temp\*.dll
• C:\Users\*\AppData\Roaming\*.exe
• C:\ProgramData\*.exe
• Faulting application name: AcroRd32.exe
• Faulting application name: Acrobat.exe

What your security team should do

• Prioritize patching or removal of affected Adobe Acrobat DC and Acrobat Reader DC versions, especially on endpoints that handle external PDFs such as finance, HR, legal, procurement, and customer support systems.
• Enable or verify Adobe automatic updates and establish recurring inventory checks for Acrobat/Reader versions.
• Deploy detection rules for Acrobat/Reader spawning command shells, scripting engines, LOLBins, archive utilities, or making unusual outbound network connections shortly after opening a PDF.
• Harden email and web gateways to sandbox PDFs from external or untrusted sources and block known-malicious or suspicious document behavior.
• Use endpoint controls to prevent PDF readers from launching child processes unless explicitly required.
• Review historical endpoint and email telemetry for suspicious PDF-open events followed by process creation, payload drops, crashes, or network callbacks.
• Ensure users are not local administrators by default to reduce the impact of code execution in the current user context.
• If suspicious activity is found, isolate affected endpoints, collect volatile and disk artifacts, preserve the original PDF, and investigate for second-stage malware or credential theft.