CVE-2021-39838

What it actually does

This is a use-after-free memory corruption flaw in Adobe Acrobat/Acrobat Reader DC when processing the AcroForm buttonGetCaption action in a crafted PDF. If a user opens a malicious document, the application can dereference freed memory in a way that allows attacker-controlled data to influence execution flow, potentially resulting in arbitrary code execution with the privileges of the current user. Successful exploitation can allow access to user files, execution of payloads, persistence setup, credential theft, or lateral-movement tooling depending on the user’s permissions and endpoint controls.

Why it matters to the business

The practical risk is compromise through a malicious PDF attachment, download, or shared document. Because Acrobat and Acrobat Reader are widely deployed on Windows and macOS desktops, this type of flaw is useful for phishing and document-delivery attacks against ordinary users. A successful attack can lead to workstation compromise, data theft, malware installation, business email compromise staging, or ransomware foothold activity if the attacker can escalate privileges or move laterally. The issue is not listed in CISA KEV and no ransomware association is provided, but the EPSS score is elevated, so organizations should treat unpatched endpoints as meaningful exposure even though exploitation requires user interaction.

How an attack unfolds

An attacker crafts a PDF containing an AcroForm element that triggers the vulnerable buttonGetCaption handling path. The PDF is delivered to a target through phishing email, a web download, file-sharing platform, messaging application, or compromised trusted source. When the victim opens the document in an affected Acrobat or Acrobat Reader version, the malformed form action causes use-after-free memory corruption. With a reliable exploit, the attacker gains code execution inside the Acrobat/Reader process as the current user. The attacker’s code may then drop or execute a second-stage payload, connect to command-and-control infrastructure, steal local data, or attempt privilege escalation and lateral movement. Sandboxing, Protected View, EDR, application control, and lack of exploit reliability can interrupt the chain, but patching is the primary control.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader on all supported Windows and macOS systems to versions newer than the affected releases: Acrobat/Reader DC later than 2021.005.20060, Acrobat/Reader 2020 later than 2020.004.30006, and Acrobat/Reader 2017 later than 2017.011.30199. Where exact package fixed versions are managed through enterprise software distribution, deploy the latest Adobe security update available for the installed track rather than only meeting the minimum version boundary. Remove unsupported Acrobat/Reader branches where possible. As compensating controls, enable Protected View and enhanced security features, restrict JavaScript and embedded content where operationally feasible, block high-risk attachment types from untrusted sources, use application control to limit child processes launched by Acrobat/Reader, and ensure endpoint protection monitors PDF reader behavior.

How to confirm the fix worked

Confirm exposure by inventorying installed Adobe Acrobat and Acrobat Reader versions across endpoints and identifying installations at or below 2021.005.20060 for DC, 2020.004.30006 for the 2020 track, or 2017.011.30199 for the 2017 track. Validate remediation by checking the application About dialog, vendor package metadata, endpoint management inventory, or OS package/application inventory after patch deployment. On Windows, review installed application records and executable file versions for Acrobat.exe and AcroRd32.exe. On macOS, review application bundle versions for Adobe Acrobat Reader.app or Adobe Acrobat.app. Confirm that automatic update policies are enabled or that enterprise patch deployment reports show successful installation. Test representative systems by opening Acrobat/Reader and verifying the version is above the vulnerable baseline.

Typical attack path

1. Prepare a malicious PDF that abuses AcroForm buttonGetCaption processing.
2. Deliver the document to a user through phishing, web download, shared storage, or another document exchange path.
3. Convince the user to open the PDF in a vulnerable version of Adobe Acrobat or Acrobat Reader.
4. Trigger the use-after-free condition during document/form processing.
5. Achieve code execution in the context of the current user.
6. Run a second-stage payload or script, establish persistence, steal data, or perform follow-on activity.
7. Attempt privilege escalation or lateral movement if the compromised user context and endpoint defenses permit it.

How to detect it

To determine whether exploitation may already have occurred, focus on endpoint and email/web telemetry rather than a single reliable signature. Review email gateways, secure web gateways, EDR, and proxy logs for suspicious PDF delivery shortly before unusual endpoint activity. On endpoints, hunt for Acrobat/Reader processes that spawned unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, wget.exe, osascript, sh, bash, or python. Review EDR process trees where Acrobat.exe, AcroRd32.exe, or Adobe Acrobat Reader initiated network connections, wrote executables or scripts to temporary/user-writable directories, modified autorun locations, or launched archive/extraction utilities. Examine crash reports and application event logs for Acrobat/Reader crashes around the time a suspicious PDF was opened, as failed exploitation attempts may appear as application faults. Analyze suspicious PDFs for AcroForm content and references to buttonGetCaption or related form actions. Because the input does not provide known malicious hashes, IPs, domains, or actor-specific tooling for this vulnerability, detection should combine vulnerable-version exposure, document provenance, PDF structure analysis, and behavioral endpoint telemetry.

• buttonGetCaption
• /AcroForm
• AcroRd32.exe -> cmd.exe
• AcroRd32.exe -> powershell.exe
• AcroRd32.exe -> wscript.exe
• AcroRd32.exe -> cscript.exe
• AcroRd32.exe -> mshta.exe
• AcroRd32.exe -> rundll32.exe
• AcroRd32.exe -> regsvr32.exe
• AcroRd32.exe -> certutil.exe
• AcroRd32.exe -> curl.exe
• AcroRd32.exe -> wget.exe
• Acrobat.exe -> cmd.exe
• Acrobat.exe -> powershell.exe
• Acrobat.exe -> wscript.exe
• Acrobat.exe -> cscript.exe
• Acrobat.exe -> mshta.exe
• Acrobat.exe -> rundll32.exe
• Acrobat.exe -> regsvr32.exe
• Acrobat.exe -> certutil.exe
• Adobe Acrobat Reader -> osascript
• Adobe Acrobat Reader -> sh
• Adobe Acrobat Reader -> bash
• Adobe Acrobat Reader -> python

What your security team should do

• Prioritize patching Acrobat and Acrobat Reader on endpoints that handle external email attachments, internet downloads, legal/finance documents, recruiting documents, or customer-submitted PDFs.
• Create an inventory-based detection for Acrobat/Reader versions at or below the affected versions and track remediation to closure.
• Enable or enforce Acrobat/Reader Protected View, Enhanced Security, and controlled update settings where business workflows allow.
• Harden endpoint controls to alert on Acrobat/Reader spawning command shells, scripting interpreters, Office applications, LOLBins, or unsigned executables.
• Review email and web security telemetry for suspicious PDFs delivered to users, especially documents containing AcroForm structures or JavaScript-like action content.
• Block or detonate externally sourced PDFs in a sandbox before delivery where feasible.
• Use EDR to hunt for post-exploitation behavior from Acrobat.exe, AcroRd32.exe, or Adobe Acrobat Reader processes, including unusual child processes, network connections, and file writes in startup or temporary locations.
• Educate users to treat unexpected PDF attachments and shared-document links as suspicious, particularly when they request enabling features, opening embedded content, or bypassing warnings.