CVE-2021-39837

What it actually does

CVE-2021-39837 is a use-after-free flaw in Adobe Acrobat and Acrobat Reader DC when processing the AcroForm JavaScript deleteItemAt action. A specially crafted PDF can corrupt memory after an object has been freed, allowing attacker-controlled code to run in the context of the user who opened the document. The flaw requires user interaction, but it does not require authentication or elevated privileges. Successful exploitation can provide confidentiality, integrity, and availability impact equivalent to the victim user’s permissions on Windows or macOS systems.

Why it matters to the business

An attacker can use a malicious PDF delivered by email, web download, file share, or messaging platform to compromise an employee workstation when the file is opened. This can lead to credential theft, malware installation, data access, lateral movement, and disruption of normal endpoint operations. Although this vulnerability is not listed in CISA KEV and has no provided evidence of ransomware use, the EPSS score is high, indicating meaningful exploitation likelihood and warranting prioritization for exposed desktop fleets that handle untrusted PDF files.

How an attack unfolds

An attacker prepares a malicious PDF containing crafted AcroForm content and JavaScript that triggers the vulnerable deleteItemAt action in affected versions of Acrobat or Acrobat Reader. The attacker then convinces a user to open the PDF, commonly through phishing, a shared document link, a compromised website, or a file transfer workflow. When the document is opened, the vulnerable PDF parser mishandles a freed object, causing memory corruption. A reliable exploit can shape heap memory and redirect execution to attacker-controlled code. Code execution occurs as the current user, after which the attacker may drop a payload, establish persistence, steal files or credentials accessible to that user, or use the compromised endpoint as an entry point for broader intrusion activity. Acrobat sandboxing, Protected Mode, and endpoint controls can reduce exploit reliability and post-exploitation impact, but patching is the primary control.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to fixed or later versions. Versions at or below Acrobat Reader DC 2021.005.20060, Acrobat/Reader 2020.004.30006, and Acrobat/Reader 2017.011.30199 are affected. Adobe’s September 2021 security updates addressed this issue; fixed release baselines include Continuous 2021.007.20091 or later, Classic 2020 2020.004.30015 or later, and Classic 2017 2017.011.30202 or later where applicable. If immediate patching is not possible, reduce risk by enabling Protected Mode and Protected View, disabling or restricting Acrobat JavaScript where business processes allow, blocking PDFs from untrusted sources, enforcing attachment sandboxing, and preventing Acrobat/Reader from launching script interpreters, shells, or unsigned child processes through EDR or application control policies.

How to confirm the fix worked

Confirm installed Acrobat and Acrobat Reader versions across Windows and macOS endpoints and verify they are newer than the affected version ranges. On Windows, check the application UI, installed programs inventory, executable metadata for AcroRd32.exe or Acrobat.exe, and software inventory tools. On macOS, check the application bundle version for Adobe Acrobat Reader.app or Adobe Acrobat.app. Validate that vulnerability scanners no longer report affected versions. Confirm that managed update channels are enabled and that endpoints are receiving Adobe security updates. Where mitigations are used, verify Protected Mode or Protected View settings and confirm application control rules block risky Acrobat child processes such as PowerShell, cmd, wscript, mshta, rundll32, curl, or osascript unless explicitly required.

Typical attack path

1. Attacker identifies organizations or users likely to open PDF attachments or document links.
2. Attacker crafts a malicious PDF that abuses AcroForm JavaScript processing, specifically the deleteItemAt action path.
3. Attacker delivers the PDF through phishing email, web download, messaging, or a shared file location.
4. Victim opens the PDF in a vulnerable Adobe Acrobat or Acrobat Reader version.
5. The PDF triggers a use-after-free condition and achieves code execution in the victim user context.
6. Payload executes, often spawning a child process, writing files, or making outbound network connections.
7. Attacker performs follow-on actions such as credential theft, command execution, persistence, or lateral movement.

How to detect it

To determine whether this vulnerability was already exploited, review endpoint, email, proxy, and file telemetry around the time users opened suspicious PDFs. On endpoints, look for Acrobat or Acrobat Reader crashes followed by child process creation, file writes in user-writable directories, new persistence entries, credential-access behavior, or unusual outbound connections. Useful Windows sources include EDR process telemetry, Sysmon Event ID 1 for process creation, Event ID 11 for file creation, Event ID 3 for network connections, Windows Application crash logs, Microsoft Defender alerts, and PowerShell logs. Useful macOS sources include EDR telemetry, Unified Logs, quarantine events, LaunchAgent or LaunchDaemon changes, and process execution history showing Acrobat spawning shell or scripting tools. In mail and web logs, search for externally delivered PDFs, archived attachments, or URLs that were opened shortly before Acrobat activity. For file analysis, inspect suspicious PDFs for AcroForm, JavaScript, OpenAction, and deleteItemAt content. Because no public exploit-specific IOC is provided for this CVE, detection should emphasize behavior: document open followed by Acrobat crash, child process execution, payload download, or persistence creation.

• deleteItemAt(
• /AcroForm
• /OpenAction
• /JavaScript
• AcroRd32.exe spawning cmd.exe
• AcroRd32.exe spawning powershell.exe
• AcroRd32.exe spawning wscript.exe
• AcroRd32.exe spawning cscript.exe
• AcroRd32.exe spawning mshta.exe
• AcroRd32.exe spawning rundll32.exe
• AcroRd32.exe spawning regsvr32.exe
• AcroRd32.exe spawning certutil.exe
• AcroRd32.exe spawning curl.exe
• Acrobat.exe spawning cmd.exe
• Acrobat.exe spawning powershell.exe
• Acrobat.exe spawning wscript.exe
• Acrobat.exe spawning mshta.exe
• Adobe Acrobat Reader.app spawning /bin/sh
• Adobe Acrobat Reader.app spawning osascript
• Adobe Acrobat Reader.app spawning curl

What your security team should do

• Prioritize patching Acrobat and Acrobat Reader on endpoints that receive external email attachments, process customer documents, or browse the web frequently.
• Hunt for suspicious Acrobat or Reader child processes, especially shells, scripting engines, LOLBins, download utilities, and unexpected network connections.
• Review email gateway, proxy, EDR, and file telemetry for PDFs containing AcroForm JavaScript and deleteItemAt references.
• Enable or enforce Adobe automatic updates across managed desktop fleets.
• Keep Protected Mode and Protected View enabled and disable Acrobat JavaScript where operationally feasible.
• Use attachment detonation or sandboxing for externally sourced PDFs before user delivery.
• Add EDR prevention rules to block Acrobat/Reader from spawning command interpreters, scripting engines, or unsigned executables.
• Educate users to treat unexpected PDFs as high risk, especially invoices, legal notices, resumes, and shared document links.