PT-2021-4002 · Adobe · Acrobat 2020+3

Published 2021-07-13 · Updated 2021-08-31 · CVE-2021-28638

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader DC versions 2017.011.30197 through 2021.005.20054 Adobe Acrobat 2017 (affected versions not specified) Adobe Acrobat 2020 (affected versions not specified) Adobe Acrobat Document Cloud (affected versions not specified)

Description The issue is related to heap-based buffer overflow errors in dynamic memory, which can be exploited by a remote attacker to impact the integrity, availability, and confidentiality of information. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file.

Recommendations For Adobe Acrobat Reader DC versions 2017.011.30197 through 2021.005.20054, update to a version later than 2021.005.20054 to resolve the issue. For Adobe Acrobat 2017, Adobe Acrobat 2020, and Adobe Acrobat Document Cloud, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2021-04526

CVE-2021-28638

ZDI-21-812

Affected Products

Acrobat 2017

Acrobat 2020

Acrobat Document Cloud

Acrobat Reader

References · 8

• https://zerodayinitiative.com/advisories/ZDI-21-812 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb21-51.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28638 · Security Note
• https://bdu.fstec.ru/vul/2021-04526 · Security Note
• https://vuldb.com/?id.178492 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28638 · Note
• https://t.me/cibsecurity/27654 · Telegram Post