CVE-2021-39840

What it actually does

CVE-2021-39840 is a use-after-free vulnerability in Adobe Acrobat and Acrobat Reader DC when processing AcroForms in PDF content. A crafted PDF or malicious web-delivered document can trigger memory corruption after the application references freed memory, allowing attacker-controlled data to influence execution flow. Successful exploitation can lead to arbitrary code execution with the privileges of the user running Acrobat or Reader. Because the CVSS vector requires user interaction but no attacker authentication, exploitation typically depends on convincing a user to open a malicious PDF or visit a page that causes Acrobat/Reader to process the malicious content.

Why it matters to the business

If exploited, this vulnerability can allow an attacker to compromise an endpoint through a document-based phishing or web lure, leading to data theft, malware installation, lateral movement, or disruption under the affected user’s permissions. Organizations with broad use of Adobe Acrobat or Reader on Windows or macOS face elevated exposure because PDF documents are commonly exchanged through email, collaboration platforms, and websites. The EPSS score is relatively high, indicating meaningful likelihood of exploitation in the wild even though it is not listed in CISA KEV; delayed patching leaves users exposed to commodity malware and targeted phishing workflows that abuse malicious PDFs.

How an attack unfolds

An attacker prepares a specially crafted PDF containing malicious AcroForm content designed to trigger the use-after-free condition in vulnerable versions of Adobe Acrobat or Acrobat Reader DC. The attacker then delivers the PDF through phishing email, file-sharing links, compromised websites, malvertising, or messaging platforms, or hosts a page that causes the victim to open or render the malicious document. When the victim opens the file or visits the malicious page, Acrobat/Reader processes the AcroForm, corrupts memory, and transfers execution to attacker-controlled shellcode or embedded payload logic. The payload then runs as the current user and may download additional malware, establish persistence, steal files or credentials accessible to the user, or use the compromised workstation as a foothold for further activity.

How to fix it

Upgrade Adobe Acrobat and Acrobat Reader to versions newer than the affected releases: Acrobat Reader DC 2021.005.20060 and earlier, Acrobat DC 2021.005.20060 and earlier, Acrobat/Reader 2020.004.30006 and earlier, and Acrobat/Reader 2017.011.30199 and earlier. Use Adobe’s official security update channel or enterprise software distribution tooling to deploy the latest available Acrobat/Reader security updates across Windows and macOS. Where immediate patching is not possible, reduce exposure by disabling or restricting JavaScript and high-risk PDF features where operationally feasible, enabling Protected View and Enhanced Security, blocking PDFs from untrusted sources at email and web gateways, and ensuring endpoint protection monitors child processes spawned by Acrobat/Reader. Remove unsupported Acrobat/Reader versions and replace them with supported releases that continue receiving security updates.

How to confirm the fix worked

Confirm installed Adobe Acrobat and Acrobat Reader versions are newer than the affected builds on all managed Windows and macOS endpoints. On Windows, validate through application inventory, Adobe update status, installed program records, and executable file versions for Acrobat.exe and AcroRd32.exe. On macOS, validate application bundle versions under the Adobe Acrobat or Acrobat Reader application paths. Test enterprise deployment rings to ensure the update applied successfully and that auto-update mechanisms are enabled where permitted. Validate hardening by confirming Protected View and Enhanced Security settings remain enabled and that email/web controls inspect or sandbox external PDFs. Exposure remains if any endpoint runs Acrobat Reader DC 2021.005.20060 or earlier, Acrobat DC 2021.005.20060 or earlier, 2020.004.30006 or earlier, or 2017.011.30199 or earlier.

Typical attack path

1. Identify organizations or users likely to open PDF documents from external sources.
2. Create a malicious PDF containing crafted AcroForm structures that trigger the use-after-free condition in vulnerable Acrobat/Reader versions.
3. Deliver the PDF through phishing email, file-sharing services, messaging platforms, compromised websites, or malicious web redirects.
4. Wait for the target user to open the document or visit a page that invokes vulnerable PDF processing.
5. Trigger memory corruption during AcroForm parsing and execute attacker-controlled code in the context of the current user.
6. Run a second-stage payload such as an infostealer, remote access trojan, downloader, or post-exploitation framework.
7. Perform follow-on actions such as credential theft, persistence, data access, lateral movement, or additional malware deployment.

How to detect it

To assess whether exploitation already occurred, review endpoint telemetry, EDR process trees, email security logs, web proxy logs, and file-system artifacts around times when users opened external PDFs. Focus on instances where Acrobat or Reader processed a PDF and then spawned unusual child processes such as command interpreters, scripting engines, download utilities, Office applications, or unknown executables. Investigate PDFs received through email or downloaded from the web shortly before suspicious process execution, especially files with AcroForms, embedded JavaScript, unusual object streams, or malformed structure. Check for outbound network connections initiated by Acrobat/Reader or by immediate child processes, particularly to newly registered domains, direct IP addresses, file-sharing services, or executable downloads. On Windows, review Security, Sysmon, PowerShell, Defender, and EDR logs for Acrobat.exe or AcroRd32.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, bitsadmin.exe, certutil.exe, curl.exe, or dropped executables in user-writable directories. On macOS, review Unified Logs and EDR telemetry for Adobe Acrobat or Reader launching shell interpreters, osascript, curl, python, or suspicious binaries from temporary or user directories. Also inspect crash logs for Acrobat/Reader crashes followed by successful execution of unrelated processes, as failed exploitation attempts may produce application crashes.

• AcroRd32.exe spawning cmd.exe
• AcroRd32.exe spawning powershell.exe
• AcroRd32.exe spawning wscript.exe
• AcroRd32.exe spawning cscript.exe
• AcroRd32.exe spawning mshta.exe
• AcroRd32.exe spawning rundll32.exe
• AcroRd32.exe spawning regsvr32.exe
• AcroRd32.exe spawning bitsadmin.exe
• AcroRd32.exe spawning certutil.exe
• AcroRd32.exe spawning curl.exe
• AcroRd32.exe spawning wget.exe
• Acrobat.exe spawning cmd.exe
• Acrobat.exe spawning powershell.exe
• Acrobat.exe spawning wscript.exe
• Acrobat.exe spawning cscript.exe
• Acrobat.exe spawning mshta.exe
• Acrobat.exe spawning rundll32.exe
• Acrobat.exe spawning regsvr32.exe
• Acrobat.exe spawning bitsadmin.exe
• Acrobat.exe spawning certutil.exe
• Acrobat.exe spawning curl.exe
• Acrobat.exe spawning wget.exe
• /Applications/Adobe Acrobat Reader.app
• /Applications/Adobe Acrobat DC/Adobe Acrobat.app
• Adobe Acrobat Reader spawning /bin/sh
• Adobe Acrobat Reader spawning /bin/bash
• Adobe Acrobat Reader spawning zsh
• Adobe Acrobat Reader spawning osascript
• Adobe Acrobat Reader spawning curl
• Adobe Acrobat Reader spawning python
• Adobe Acrobat spawning /bin/sh
• Adobe Acrobat spawning /bin/bash
• Adobe Acrobat spawning zsh
• Adobe Acrobat spawning osascript
• Adobe Acrobat spawning curl
• Adobe Acrobat spawning python
• C:\Users\*\AppData\Local\Temp\*.exe launched after AcroRd32.exe
• C:\Users\*\AppData\Local\Temp\*.dll loaded after AcroRd32.exe
• C:\Users\*\AppData\Roaming\*.exe launched after AcroRd32.exe
• C:\Users\*\Downloads\*.pdf opened before suspicious child process
• AcroRd32.exe outbound connection to external IP
• Acrobat.exe outbound connection to external IP
• Adobe Acrobat Reader crash followed by child process execution
• Adobe Acrobat crash followed by child process execution

What your security team should do

• Prioritize patching Adobe Acrobat and Acrobat Reader across all user workstations, especially systems used for email, finance, HR, legal, customer support, and other document-heavy workflows.
• Inventory Acrobat/Reader versions across Windows and macOS and isolate or remediate endpoints running affected or unsupported builds.
• Enable or enforce Adobe Protected View and Enhanced Security settings, particularly for files originating from the internet or email attachments.
• Harden email and web gateways to detonate, inspect, or block suspicious PDFs, especially those containing AcroForms, JavaScript, embedded objects, or unusual structure.
• Create detections for Adobe Acrobat/Reader spawning command shells, scripting engines, archive tools, download utilities, or unsigned executables.
• Review historical endpoint and email telemetry for suspicious PDFs opened by users followed by unusual Acrobat/Reader child processes or network connections.
• Educate users to treat unexpected PDF attachments and file-sharing links as suspicious, particularly when they request enabling features, submitting form content, or opening external content.
• Remove end-of-life Adobe Acrobat/Reader branches where possible and standardize on supported versions with automatic security updates enabled.