CVE-2021-39843

What it actually does

This is a memory-corruption vulnerability in Adobe Acrobat and Acrobat Reader DC caused by an out-of-bounds write while parsing a malicious document. If successfully triggered, the flaw can corrupt process memory and allow attacker-controlled code to execute with the privileges of the user who opened the file. Because Acrobat/Reader commonly run on Windows and macOS endpoints and often handle untrusted PDFs, exploitation can lead to full compromise of the user session, data access available to that user, and potential follow-on activity if the attacker escapes application sandboxing or abuses user privileges.

Why it matters to the business

A successful attack can turn a seemingly routine PDF into an endpoint compromise. An attacker could steal documents, credentials, browser/session data, or other files accessible to the signed-in user, install persistence, or use the workstation as a foothold for lateral movement. The CVSS score is high and EPSS is elevated, indicating meaningful exploitation likelihood even though it is not currently listed in CISA KEV and no specific public exploit maturity was provided. Organizations with broad Acrobat/Reader deployments should treat this as a priority endpoint patching issue because exploitation requires only convincing a user to open a malicious file.

How an attack unfolds

An attacker prepares a specially crafted PDF or other Acrobat-handled file that triggers the out-of-bounds write during parsing. The attacker then delivers the file through phishing email, web download, file-sharing links, compromised websites, or collaboration platforms. When a victim opens the file in a vulnerable version of Adobe Acrobat or Acrobat Reader DC, malformed document content corrupts memory in the application process. With reliable exploitation, the attacker gains code execution in the context of the current user. From there, the attacker may launch a payload, write files, establish persistence, collect local data, attempt credential theft, or pivot using the compromised user’s permissions. Because user interaction is required, social engineering and document-delivery telemetry are important parts of both prevention and detection.

How to fix it

Update Adobe Acrobat and Adobe Acrobat Reader DC to a vendor-supported version newer than the affected releases: later than 2021.005.20060 for the Continuous track, later than 2020.004.30006 for the 2020 Classic track, and later than 2017.011.30199 for the 2017 Classic track. Where exact package targets are managed centrally, deploy the latest available Adobe security update for the relevant track rather than only meeting the minimum fixed baseline. If immediate patching is not possible, reduce exposure by disabling or restricting Acrobat/Reader handling of untrusted files, enforcing Protected View and Enhanced Security, blocking PDF attachments from untrusted senders where feasible, opening suspicious PDFs in isolated/sandboxed environments, and limiting child-process creation from Acrobat/Reader through EDR, application control, or attack surface reduction policies. Remove unsupported Acrobat/Reader versions from endpoints.

How to confirm the fix worked

Confirm installed Acrobat/Reader versions across Windows and macOS fleets and verify they are later than the affected versions listed by Adobe. On Windows, check installed application inventory, Add/Remove Programs data, file metadata for Acrobat.exe and AcroRd32.exe, and enterprise software management reports. On macOS, check application bundle versions for Acrobat/Reader under standard application paths and MDM inventory. Validate that Protected View and Enhanced Security are enabled where operationally feasible. Test endpoint controls to ensure Acrobat/Reader cannot spawn high-risk child processes such as command shells, scripting engines, or download utilities unless explicitly required. Confirm that mail, web, and EDR telemetry can identify Acrobat/Reader opening externally sourced documents and producing unusual child processes, network connections, or file writes.

Typical attack path

1. Identify targets likely to use Adobe Acrobat or Acrobat Reader on Windows or macOS.
2. Create or obtain a malicious document designed to trigger the out-of-bounds write vulnerability.
3. Deliver the file through phishing, malicious links, file-sharing services, or compromised websites.
4. Convince the victim to open the malicious file with a vulnerable Acrobat or Acrobat Reader version.
5. Trigger memory corruption and execute attacker-controlled code as the current user.
6. Run a second-stage payload, script, or command shell from the Acrobat/Reader process context.
7. Steal accessible files or credentials, establish persistence, or attempt lateral movement depending on privileges and endpoint controls.

How to detect it

To determine whether exploitation has already occurred, review endpoint, EDR, email, web proxy, and file-system telemetry around PDF handling. Focus on Acrobat/Reader processes opening files from email clients, browser download folders, temporary directories, archive extraction paths, or network shares, followed by abnormal behavior such as child-process creation, outbound connections, executable file drops, script execution, credential-access tooling, or persistence changes. On Windows, investigate parent-child process chains where Acrobat.exe, AcroRd32.exe, or related Adobe Reader processes spawn cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, or suspicious installers. Review Windows Security, Sysmon, PowerShell, EDR, proxy/DNS, and email gateway logs for the original document source and subsequent payload activity. On macOS, review Unified Logs, EDR telemetry, quarantine events, browser/download metadata, and process execution where Adobe Acrobat/Reader launches shells, osascript, curl, Python, or writes LaunchAgents. Look for recently opened PDFs that correlate with crashes, application hangs, suspicious spawned processes, or new persistence artifacts. No vulnerability-specific exploit string is publicly derivable from the provided data, so detection should emphasize behavioral indicators of document-based code execution rather than a single static signature.

• AcroRd32.exe spawning cmd.exe
• AcroRd32.exe spawning powershell.exe
• AcroRd32.exe spawning wscript.exe
• AcroRd32.exe spawning cscript.exe
• AcroRd32.exe spawning mshta.exe
• AcroRd32.exe spawning rundll32.exe
• AcroRd32.exe spawning regsvr32.exe
• AcroRd32.exe spawning certutil.exe
• AcroRd32.exe spawning bitsadmin.exe
• AcroRd32.exe spawning curl.exe
• AcroRd32.exe spawning wget.exe
• Acrobat.exe spawning cmd.exe
• Acrobat.exe spawning powershell.exe
• Acrobat.exe spawning wscript.exe
• Acrobat.exe spawning cscript.exe
• Acrobat.exe spawning mshta.exe
• Acrobat.exe spawning rundll32.exe
• Acrobat.exe spawning regsvr32.exe
• Acrobat.exe spawning certutil.exe
• Acrobat.exe spawning bitsadmin.exe
• Acrobat.exe spawning curl.exe
• Acrobat.exe spawning wget.exe
• /Applications/Adobe Acrobat Reader.app
• /Applications/Adobe Acrobat DC/Adobe Acrobat.app
• Adobe Acrobat Reader spawning /bin/sh
• Adobe Acrobat Reader spawning /bin/bash
• Adobe Acrobat Reader spawning osascript
• Adobe Acrobat Reader spawning curl
• Adobe Acrobat Reader spawning python
• ~/Library/LaunchAgents/
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

What your security team should do

• Prioritize patch deployment for all Adobe Acrobat and Acrobat Reader installations, especially endpoints used for email, document intake, finance, legal, HR, helpdesk, and other roles that regularly open external PDFs.
• Inventory and remove unsupported Acrobat/Reader versions, including legacy 2017 track deployments where possible.
• Harden Acrobat/Reader by enabling Protected View and Enhanced Security and disabling unnecessary JavaScript or high-risk document features where business workflows allow.
• Create EDR or application-control rules to alert on or block Acrobat/Reader spawning command shells, PowerShell, scripting engines, Office applications, archive tools, or download utilities.
• Hunt for suspicious Acrobat/Reader process behavior, especially child processes, unexpected network connections, dropped executables, and documents opened from email, browser cache, temporary directories, or user downloads folders.
• Strengthen email and web filtering for suspicious PDFs, compressed attachments containing PDFs, and links to externally hosted documents.
• Use user-awareness messaging focused on unexpected PDF attachments and document-sharing links, particularly from external senders.
• Because EPSS is elevated, treat unresolved exposure as higher urgency even though this vulnerability is not currently listed in CISA KEV.