CVE-2021-28639

What it actually does

This is a use-after-free memory corruption flaw in Adobe Acrobat Reader DC. A specially crafted document can cause Reader to reference memory after it has been freed, allowing attacker-controlled data to influence program execution. If exploitation succeeds, the attacker can execute arbitrary code with the privileges of the user who opened the file. The CVSS vector indicates local execution with required user interaction, no prior authentication, and high impact to confidentiality, integrity, and availability.

Why it matters to the business

Successful exploitation can turn a routine document-opening action into workstation compromise. An attacker may steal files and credentials accessible to the user, install malware, move laterally from the endpoint, or disrupt user operations. The EPSS score is high and stable at approximately 66%, which suggests meaningful exploitation likelihood despite the record not being listed in CISA KEV and no ransomware association being provided. Organizations that widely allow PDF attachments or use Acrobat Reader on user workstations should treat this as a priority endpoint patching issue.

How an attack unfolds

An attacker prepares a malicious PDF or other Reader-supported file that triggers the use-after-free condition when parsed or rendered. The file is delivered through phishing email, a shared document link, a compromised website, or another social-engineering channel. When the victim opens the file in a vulnerable version of Acrobat Reader DC, the crafted content manipulates heap memory so execution flow is redirected to attacker-controlled code. The payload then runs as the current user, commonly followed by command execution, script launch, payload download, credential theft, persistence setup, or lateral movement. Exploitation requires user interaction, but no authentication to the target system is required.

How to fix it

Upgrade Adobe Acrobat Reader DC to a version newer than the vulnerable releases: 2021.005.20054 and earlier, 2020.004.30005 and earlier, and 2017.011.30197 and earlier are affected according to the description. Apply the relevant Adobe security update across all managed endpoints and remove unsupported Reader branches where possible. Keep Protected Mode and Enhanced Security enabled, restrict opening of untrusted attachments, block document-initiated script execution where feasible, and ensure endpoint protection monitors child processes spawned by PDF readers. The supplied package metadata also lists grafana/grafana fixed at commit d409b0ca1698668f2b787a66afa72adcd3688cb2 and github.com/grafana/grafana fixed in 8.2.4; because that product metadata does not align with the Acrobat Reader vulnerability description, validate advisory mapping in asset and dependency tooling before using those package versions as the sole remediation basis.

How to confirm the fix worked

Confirm installed Acrobat Reader versions are later than the affected versions listed in the advisory. Use endpoint management, software inventory, or vulnerability scanning to identify remaining installations of Reader DC 2021.005.20054 or earlier, 2020.004.30005 or earlier, and 2017.011.30197 or earlier. Verify Adobe automatic updates are enabled and that Protected Mode and Enhanced Security remain active after patching. For dependency scanners that report this issue against Grafana package coordinates, validate whether the finding is a metadata correlation error or a separate downstream advisory, and confirm any Grafana instances or dependencies are at least github.com/grafana/grafana 8.2.4 or include commit d409b0ca1698668f2b787a66afa72adcd3688cb2 if that mapping is applicable.

Typical attack path

1. Identify organizations or users likely to open PDF attachments or shared documents.
2. Craft or acquire a malicious document designed to trigger the Acrobat Reader use-after-free condition.
3. Deliver the file through phishing, a document-sharing service, removable media, or a compromised website.
4. Convince the victim to open the file in a vulnerable Reader version.
5. Exploit memory corruption to execute code in the current user context.
6. Launch a second-stage payload or living-off-the-land tool from the Reader process.
7. Establish persistence, steal data or credentials, and attempt lateral movement depending on user privileges.

How to detect it

Look for evidence that a vulnerable Acrobat Reader process opened an untrusted document and then behaved like a malware launcher. Relevant sources include EDR process telemetry, Windows Security logs with process creation, Sysmon Event ID 1 process creation, Sysmon Event ID 3 network connections, Windows Application crash logs, email gateway attachment logs, web proxy download logs, browser download history, and file creation events in user Downloads, Temp, and email attachment cache directories. Prioritize events where AcroRd32.exe or Acrobat.exe spawns cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or installer binaries. Also review Reader crashes immediately followed by suspicious process execution or outbound network connections, as memory-corruption attempts often cause crashes during failed exploitation. Correlate suspicious PDF receipt or download time with subsequent process execution, credential access, persistence changes, or network beaconing. No unique public file hash, domain, or exploit string is provided in the input, so detections should be behavior-based rather than signature-only.

• ParentImage=*\\AcroRd32.exe Image=*\\powershell.exe
• ParentImage=*\\AcroRd32.exe Image=*\\cmd.exe
• ParentImage=*\\AcroRd32.exe Image=*\\wscript.exe
• ParentImage=*\\AcroRd32.exe Image=*\\cscript.exe
• ParentImage=*\\AcroRd32.exe Image=*\\mshta.exe
• ParentImage=*\\AcroRd32.exe Image=*\\rundll32.exe
• ParentImage=*\\AcroRd32.exe Image=*\\regsvr32.exe
• ParentImage=*\\AcroRd32.exe Image=*\\certutil.exe
• ParentImage=*\\AcroRd32.exe Image=*\\bitsadmin.exe
• ParentImage=*\\Acrobat.exe Image=*\\powershell.exe
• ParentImage=*\\Acrobat.exe Image=*\\cmd.exe
• ParentImage=*\\Acrobat.exe Image=*\\wscript.exe
• ParentImage=*\\Acrobat.exe Image=*\\cscript.exe
• ParentImage=*\\Acrobat.exe Image=*\\mshta.exe
• ParentImage=*\\Acrobat.exe Image=*\\rundll32.exe
• ParentImage=*\\Acrobat.exe Image=*\\regsvr32.exe
• Faulting application name: AcroRd32.exe
• Faulting application name: Acrobat.exe
• %TEMP%\\*.pdf.exe
• %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.lnk

What your security team should do

• Prioritize patching vulnerable Acrobat Reader installations because exploitation requires only convincing a user to open a malicious file and EPSS is high.
• Hunt for suspicious child processes launched by AcroRd32.exe or Acrobat.exe, especially script interpreters, command shells, LOLBins, and network-capable utilities.
• Block or detonate inbound PDF attachments from untrusted senders in email security gateways and sandboxing tools.
• Ensure Adobe Protected Mode and Enhanced Security are enabled through policy.
• Use EDR controls to prevent PDF readers from spawning powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or installer/downloader processes unless explicitly required.
• Review software inventory and vulnerability scanner mappings for the provided Grafana package entries because they appear inconsistent with the Acrobat Reader vulnerability description.
• Educate users to avoid opening unexpected document attachments or shared-file links, especially from external senders.