Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution

published 2021-02-11 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8423

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2021-11-03
epss: 86.3%; EPSS 86.3% chance of exploitation in 30 days, percentile 99.7%
public exploits: 0; none known

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Patch / fix

cisa required action Apply updates per vendor instructions.

Timeline

2021-02-09 0-day patched (Project Zero)
2021-02-11 Published
2021-11-03 Added to CISA KEV
2021-11-17 CISA patch deadline
2025-02-04 CISA SSVC: exploitation active

Known exploited

Added: 5 y ago (2021-11-03)
Patch by: 2021-11-17 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Adobe, Acrobat and Reader
CISA name: Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched: 2021-02-09
Details: project zero tracker

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1204.002 Malicious File exploitation

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 21 mo ago (2025-02-04)

Exploit prediction

86.27% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Adobe Acrobat Reader

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

helpx.adobe.com /security/products/acrobat/apsb21-09.html
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21017
government-resource, third-party-advisory, us-government-resource

Sources

CVE List CVE-2021-21017
NVD CVE-2021-21017

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary