PT-2021-2326 · Adobe · Acrobat Reader

Published 2021-02-09 · Updated 2022-08-19 · CVE-2021-21046

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Acrobat Reader DC versions 2020.013.20074 and earlier Acrobat Reader DC versions 2020.001.30018 and earlier Acrobat Reader DC versions 2017.011.30188 and earlier

Description The issue is related to a memory corruption vulnerability that can be exploited by an unauthenticated attacker to cause an application denial-of-service. Exploitation requires user interaction, where a victim must open a malicious file. This can be achieved through a specially crafted PDF file, allowing a remote attacker to cause a denial-of-service.

Recommendations For versions 2020.013.20074 and earlier, consider avoiding the use of the affected software until a patch is available. For versions 2020.001.30018 and earlier, restrict the opening of PDF files from untrusted sources to minimize the risk of exploitation. For versions 2017.011.30188 and earlier, as a temporary workaround, consider disabling the ability to open PDF files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Corruption

Access of Memory Location After End of Buffer

Weakness Enumeration

CWE-787

CWE-788

Related Identifiers

BDU:2021-01561

CVE-2021-21046

Affected Products

Acrobat Reader

References · 8

• https://helpx.adobe.com/security/products/acrobat/apsb21-09.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21046 · Security Note
• https://bdu.fstec.ru/vul/2021-01561 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21046 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21046 · Note
• https://t.me/cvenotify/34813 · Telegram Post
• https://t.me/cibsecurity/23469 · Telegram Post
• https://t.me/cvenotify/9933 · Telegram Post