CVE-2021-40728

What it actually does

CVE-2021-40728 is a use-after-free vulnerability in Adobe Acrobat and Acrobat Reader DC/Classic when processing the GetURL function on a global window object inside a malicious PDF. If triggered, memory previously freed by the application can be reused in a controlled way, allowing attacker-supplied code to execute with the privileges of the user running Acrobat or Reader. The flaw requires local user interaction: the victim must open a crafted file. Successful exploitation can provide full confidentiality, integrity, and availability impact for the affected user context, including file access, malware execution, credential theft from the user session, and persistence setup. Sandbox or Protected Mode controls may limit immediate impact, but attackers may pair the issue with sandbox escapes or abuse permitted user-level actions.

Why it matters to the business

A successful attack can turn a normal document-opening workflow into workstation compromise. Because Acrobat Reader is widely deployed across Windows and macOS endpoints, exposure can be broad even when only a subset of users handle external PDFs. Operational consequences include malware installation, data theft from the affected user profile, lateral movement using stolen credentials, business email compromise, and disruption if ransomware or destructive payloads are delivered after initial execution. The vulnerability is old but still relevant on unmanaged or legacy endpoints; the EPSS score is high enough to justify prioritizing verification of patch coverage even though it is not currently listed in CISA KEV and is not identified as ransomware-associated in KEV metadata.

How an attack unfolds

An attacker typically creates a PDF containing JavaScript or document actions that exercise the vulnerable GetURL handling path in Acrobat or Reader. The malicious document is delivered through phishing email, file-sharing links, compromised websites, chat messages, or document exchange workflows. When the victim opens the PDF in a vulnerable version, the crafted content triggers a use-after-free condition. The attacker shapes memory so that the freed object is replaced with attacker-controlled data, redirecting execution to shellcode or a payload stage. The payload then runs as the current user, commonly followed by downloading malware, launching script interpreters, extracting files, stealing browser or email data, or establishing persistence. If application sandboxing is enabled, exploitation may still cause a crash or constrained code execution unless paired with another weakness or post-exploitation technique.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to a supported version that includes Adobe's fix for CVE-2021-40728; where exact fixed package versions are not centrally tracked, update to the latest available Acrobat/Reader release for each supported channel and platform. Remove unsupported Acrobat/Reader versions, especially legacy Classic tracks, from endpoints. Enable automatic Adobe updates where operationally feasible. Keep Protected Mode, Enhanced Security, and Protected View enabled for untrusted files. Reduce exposure by blocking or warning on PDFs from untrusted sources, disabling unnecessary JavaScript in Acrobat/Reader where business processes allow, and opening untrusted documents in isolated viewers or virtualized environments. If patching must be delayed, use endpoint application control, email attachment sandboxing, and EDR rules to restrict Acrobat/Reader from launching child processes or writing executable content to temporary directories.

How to confirm the fix worked

Confirm that all installations of Adobe Acrobat and Acrobat Reader are on a supported, current release newer than the vulnerable versions listed: 21.007.20095 and earlier, 21.007.20096 and earlier, 20.004.30015 and earlier, and 17.011.30202 and earlier. Validate version coverage using software inventory, endpoint management tools, vulnerability scanners, or direct product version checks. On Windows, inspect installed program inventory and executable metadata for AcroRd32.exe and Acrobat.exe. On macOS, verify the application bundle version for Adobe Acrobat Reader and Adobe Acrobat. Test that automatic updates are enabled or centrally managed. Confirm that Protected Mode/Enhanced Security settings remain enabled after the upgrade. Validate mitigation by ensuring Acrobat/Reader cannot spawn high-risk child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, curl, or bash during normal document viewing workflows.

Typical attack path

1. Identify organizations or users likely to open external PDF attachments or links.
2. Craft a malicious PDF that triggers the Acrobat/Reader GetURL use-after-free condition.
3. Deliver the file through phishing, document-sharing platforms, compromised websites, or business communication channels.
4. Convince the user to open the PDF in a vulnerable Acrobat or Reader version.
5. Trigger memory corruption and execute attacker-controlled code in the current user's context.
6. Drop or download a second-stage payload such as a loader, remote access tool, credential stealer, or script.
7. Use the compromised user session for persistence, data theft, lateral movement, or further malware deployment.

How to detect it

To determine whether exploitation may already have occurred, review email, web proxy, EDR, endpoint, and file telemetry for suspicious PDFs opened by Adobe Acrobat or Reader, especially around user-reported phishing or unexpected crashes. On Windows, examine Security Event ID 4688, Sysmon Event ID 1, EDR process trees, Windows Error Reporting, application crash logs, Prefetch, Amcache, ShimCache, SRUM, browser download history, and user Downloads/Temp directories. Look for AcroRd32.exe or Acrobat.exe opening a PDF and then crashing, spawning child processes, writing executables/scripts, or making unexpected outbound network connections. On macOS, review Unified Logs, quarantine events, download history, LaunchAgents/LaunchDaemons, and process telemetry for Adobe Acrobat Reader or Acrobat launching shell commands or writing payloads. Inspect suspect PDFs for JavaScript, OpenAction entries, embedded files, launch actions, obfuscation, and URL-calling behavior. Network indicators are campaign-specific, so prioritize behavioral evidence: document viewer process followed by script execution, downloader activity, credential access, persistence creation, or unusual connections. Because no universal public exploit IOC is inherent to this vulnerability, detections should combine vulnerable-version exposure with suspicious Acrobat/Reader child-process, crash, and document-content signals.

• AcroRd32.exe spawning cmd.exe
• AcroRd32.exe spawning powershell.exe
• AcroRd32.exe spawning wscript.exe
• AcroRd32.exe spawning cscript.exe
• AcroRd32.exe spawning mshta.exe
• AcroRd32.exe spawning rundll32.exe
• AcroRd32.exe spawning regsvr32.exe
• AcroRd32.exe spawning certutil.exe
• AcroRd32.exe spawning bitsadmin.exe
• Acrobat.exe spawning cmd.exe
• Acrobat.exe spawning powershell.exe
• Acrobat.exe spawning wscript.exe
• Acrobat.exe spawning cscript.exe
• Acrobat.exe spawning mshta.exe
• Acrobat.exe spawning rundll32.exe
• Acrobat.exe spawning regsvr32.exe
• Acrobat.exe spawning certutil.exe
• Acrobat.exe spawning bitsadmin.exe
• Application Error AcroRd32.exe
• Application Error Acrobat.exe
• Faulting application name: AcroRd32.exe
• Faulting application name: Acrobat.exe
• /JavaScript
• /OpenAction
• /AA
• /Launch
• /EmbeddedFile
• getURL(
• GetURL
• global.window

What your security team should do

• Prioritize patch verification for all Acrobat and Acrobat Reader installations because the affected software is commonly exposed through email and document workflows and the EPSS score indicates meaningful exploitation likelihood.
• Block or detonate inbound PDFs from untrusted senders, especially PDFs containing JavaScript, OpenAction, launch actions, embedded files, or suspicious URL-triggering behavior.
• Deploy EDR/SIEM detections for Acrobat or Reader spawning command shells, scripting engines, LOLBins, archive tools, download utilities, or unsigned executables.
• Hunt historical endpoint telemetry for Acrobat/Reader crashes followed by process execution, outbound network connections, or file writes in temporary and user-writable directories.
• Keep Acrobat Protected Mode, Enhanced Security, and Protected View enabled and prevent users from disabling them without administrative approval.
• Remove unsupported Acrobat/Reader versions and legacy channels from managed endpoints.
• Educate users and help desk teams that unexpected PDFs requesting trust, enabling features, or opening from unfamiliar senders should be reported rather than opened.
• If suspicious activity is found, isolate the endpoint, preserve the PDF and process telemetry, collect memory/disk artifacts where possible, and reset credentials used from the affected user session.