CVE-2021-44703

What it actually does

This is a memory-corruption vulnerability in Adobe Acrobat and Acrobat Reader caused by insecure handling of a crafted document, leading to a stack buffer overflow. If a user opens a malicious file, the attacker may achieve arbitrary code execution in the context of that user. Successful exploitation can allow the attacker to read, modify, or delete files accessible to the user, execute additional payloads, establish persistence, or pivot using the compromised user’s privileges. The CVSS vector indicates local attack execution through user interaction, no prior privileges required, and high confidentiality, integrity, and availability impact.

Why it matters to the business

An attacker can turn a routine document-opening action into endpoint compromise, which is especially relevant for organizations that frequently receive PDFs or office documents from external parties. Compromise may lead to data theft, malware deployment, business email compromise, ransomware staging, or disruption of employee workstations. Although this issue is not currently listed in CISA KEV and ransomware use is not indicated, the EPSS score is elevated, meaning exploitation likelihood is materially higher than many vulnerabilities. Because the vulnerability has been public for years, unpatched Acrobat or Reader installations should be treated as avoidable and high-priority exposure.

How an attack unfolds

An attacker prepares a specially crafted file designed to trigger the stack buffer overflow in vulnerable versions of Adobe Acrobat or Acrobat Reader. The file is delivered through a channel that encourages user interaction, such as phishing email, file-sharing links, messaging platforms, compromised websites, or document exchange workflows. When the victim opens the file in a vulnerable Acrobat or Reader version, the malformed content corrupts process memory and can redirect execution to attacker-controlled code. The payload runs with the privileges of the current user, after which the attacker may drop malware, launch command interpreters or scripting tools, contact command-and-control infrastructure, steal files or credentials accessible to the user, and attempt privilege escalation or lateral movement. Exploitation is constrained by endpoint protections, sandboxing, exploit mitigations, and the user’s permissions, but successful exploitation provides a strong initial foothold on the endpoint.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to currently supported, fully patched versions on Windows and macOS. Because no fixed package list was provided, use Adobe’s latest release channel and ensure installed versions are newer than the affected releases: Acrobat Reader DC 21.007.20099 and earlier, Acrobat DC 21.007.20099 and earlier, Acrobat/Reader 2020 20.004.30017 and earlier, and Acrobat/Reader 2017 17.011.30204 and earlier. Remove end-of-life Acrobat/Reader versions wherever possible. Enable automatic updates for Adobe products, enforce patch compliance through endpoint management, and verify that both Acrobat and Reader variants are covered. As mitigations where immediate patching is not possible, restrict untrusted document handling, use protected view/sandbox features, block risky attachment types from untrusted senders where business-acceptable, limit local user privileges, and ensure EDR controls monitor Acrobat/Reader child processes and suspicious network activity.

How to confirm the fix worked

Confirm exposure by inventorying Acrobat and Acrobat Reader installations across Windows and macOS endpoints and comparing versions against the affected ranges. On Windows, validate via installed application inventory, Adobe update tooling, endpoint management data, or file version checks for Acrobat.exe and AcroRd32.exe. On macOS, validate the application bundle version for Adobe Acrobat Reader or Adobe Acrobat. Confirm remediation by verifying that vulnerable versions are no longer present and that auto-update policies are enabled. As an operational validation, open Adobe Acrobat/Reader and confirm it reports a current patched build from a supported release train. Review endpoint controls to ensure Acrobat/Reader processes are prevented from launching suspicious child processes such as command shells, PowerShell, script interpreters, or download utilities unless explicitly required.

Typical attack path

1. Identify an organization or user likely to open externally supplied PDF files.
2. Craft or obtain a malicious document that triggers the Acrobat/Reader stack buffer overflow.
3. Deliver the document using phishing, file-sharing, messaging, or another social engineering path.
4. Convince the user to open the file in a vulnerable version of Adobe Acrobat or Acrobat Reader.
5. Exploit memory corruption to execute code in the context of the current user.
6. Spawn or inject follow-on processes, download a second-stage payload, or establish outbound command-and-control communication.
7. Perform credential access, data collection, persistence, privilege escalation, or lateral movement depending on attacker objectives.

How to detect it

To determine whether exploitation has already occurred, review endpoint detection telemetry, Windows Event Logs, macOS unified logs, application crash logs, email gateway logs, proxy/DNS logs, and file creation events involving Acrobat or Reader. Focus on sequences where Acrobat.exe, AcroRd32.exe, or the macOS Adobe Acrobat application opens a recently received document and then crashes, spawns a child process, writes executable content, or makes unexpected outbound network connections. On Windows, investigate Application Error events, Windows Error Reporting entries, and EDR process trees showing Acrobat/Reader launching cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or similar tools. Look for crash exception codes associated with memory corruption or stack buffer overrun, including 0xc0000409 and access violations, especially when followed by new persistence, downloads, or network beacons. On macOS, review crash reports under DiagnosticReports and process telemetry for Adobe Acrobat Reader spawning shell, osascript, curl, Python, or other utilities. Email and web logs should be searched for suspicious attachments or links delivered shortly before Acrobat/Reader crashes or abnormal process activity. Because no public exploit-specific file hash or payload marker is provided, detection should emphasize behavior and process lineage rather than static indicators.

• AcroRd32.exe
• Acrobat.exe
• acrord32.exe
• Adobe Acrobat Reader
• Exception code: 0xc0000409
• Stack buffer overrun
• Application Error
• Windows Error Reporting
• AcroRd32.exe cmd.exe
• AcroRd32.exe powershell.exe
• AcroRd32.exe wscript.exe
• AcroRd32.exe cscript.exe
• AcroRd32.exe mshta.exe
• AcroRd32.exe rundll32.exe
• AcroRd32.exe regsvr32.exe
• AcroRd32.exe certutil.exe
• AcroRd32.exe bitsadmin.exe
• Acrobat.exe cmd.exe
• Acrobat.exe powershell.exe
• Acrobat.exe wscript.exe
• Acrobat.exe cscript.exe
• Acrobat.exe mshta.exe
• Acrobat.exe rundll32.exe
• Acrobat.exe regsvr32.exe
• Acrobat.exe certutil.exe
• Acrobat.exe bitsadmin.exe
• /Library/Logs/DiagnosticReports/Adobe Acrobat Reader
• ~/Library/Logs/DiagnosticReports/Adobe Acrobat Reader
• /Applications/Adobe Acrobat Reader.app
• /Applications/Adobe Acrobat DC/Adobe Acrobat.app

What your security team should do

• Prioritize patching or removal of vulnerable Adobe Acrobat and Acrobat Reader installations, especially on endpoints handling external documents or email attachments.
• Use endpoint management or vulnerability scanning to identify all Acrobat/Reader versions at or below the affected releases and track remediation to closure.
• Enable and enforce Adobe automatic updates, and remove unsupported Acrobat/Reader release trains where feasible.
• Harden document handling by enabling protected view/sandboxing and limiting users’ ability to disable security features.
• Create detections for Acrobat/Reader spawning unusual child processes, writing executables to user-writable paths, or initiating unexpected outbound network connections.
• Search historical EDR, proxy, email, and crash telemetry for suspicious Acrobat/Reader activity around document-open events.
• Treat any confirmed exploitation as endpoint compromise: isolate the host, collect forensic artifacts, reset exposed credentials as needed, and hunt for second-stage payloads or lateral movement.