CVE-2021-28550: Adobe Acrobat DC RCE Vulnerability

CVE-2021-28550 Overview

CVE-2021-28550 is a Use After Free vulnerability affecting Adobe Acrobat Reader DC and related Adobe PDF products. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise.

Affected Products

• Adobe Acrobat DC (Continuous) versions 2021.001.20150 and earlier
• Adobe Acrobat Reader DC (Continuous) versions 2021.001.20150 and earlier
• Adobe Acrobat (Classic 2020) versions 2020.001.30020 and earlier
• Adobe Acrobat Reader (Classic 2020) versions 2020.001.30020 and earlier
• Adobe Acrobat (Classic 2017) versions 2017.011.30194 and earlier
• Adobe Acrobat Reader (Classic 2017) versions 2017.011.30194 and earlier
• Affected on both Microsoft Windows and Apple macOS platforms

Discovery Timeline

• 2021-09-02 - CVE-2021-28550 published to NVD
• 2025-10-23 - Last updated in NVD database

Technical Details for CVE-2021-28550

Vulnerability Analysis

This Use After Free (CWE-416) vulnerability exists in Adobe Acrobat and Reader products across multiple release tracks. The flaw occurs when the application continues to use memory after it has been freed, allowing an attacker to corrupt memory and potentially execute arbitrary code. Use After Free vulnerabilities are particularly dangerous in document rendering applications like PDF readers because they process complex, untrusted file formats that can trigger specific memory allocation patterns.

The vulnerability requires user interaction for exploitation—specifically, the victim must open a specially crafted malicious PDF document. Once opened, the malicious file triggers the Use After Free condition, allowing the attacker's code to execute with the same privileges as the current user. This could lead to complete system compromise, data exfiltration, or further lateral movement within an organization's network.

Root Cause

The vulnerability stems from improper memory management within Adobe's PDF processing engine. When certain PDF structures or embedded content are processed, the application incorrectly frees memory while still maintaining references to that memory location. Subsequent operations that attempt to access this freed memory can lead to undefined behavior, which attackers can manipulate to achieve code execution.

Attack Vector

The attack is delivered over the network through malicious PDF documents. Common delivery mechanisms include:

• Email attachments containing weaponized PDF files
• Malicious links to PDF documents hosted on attacker-controlled servers
• Drive-by downloads through compromised websites
• Social engineering tactics to convince users to open PDF files

Once a user opens the malicious PDF file in a vulnerable version of Adobe Acrobat or Reader, the exploit triggers the Use After Free condition. The attacker can manipulate heap memory to place controlled data at the freed memory location, ultimately hijacking the execution flow to run arbitrary code.

The vulnerability affects both Windows and macOS platforms, making it a cross-platform threat. Given its inclusion in CISA's KEV catalog, organizations should treat this vulnerability with high priority for remediation.

Detection Methods for CVE-2021-28550

Indicators of Compromise

• Unusual PDF files with anomalous embedded JavaScript or form elements
• Adobe Acrobat or Reader processes spawning unexpected child processes
• Memory corruption crashes in AcroRd32.exe or Acrobat.exe processes
• Unexpected network connections originating from PDF reader processes

Detection Strategies

• Monitor for Adobe Reader/Acrobat crash reports that may indicate exploitation attempts
• Implement endpoint detection rules for unusual process behavior from PDF applications
• Deploy email gateway scanning for potentially malicious PDF attachments
• Use sandbox analysis for PDF documents from untrusted sources

Monitoring Recommendations

• Enable Windows Event logging for process creation events (Event ID 4688) to detect suspicious child processes from Adobe applications
• Configure SentinelOne to monitor for behavioral indicators of code execution from document readers
• Implement file integrity monitoring for Adobe installation directories
• Review SIEM alerts for patterns consistent with document-based exploitation

How to Mitigate CVE-2021-28550

Immediate Actions Required

• Update all Adobe Acrobat and Reader installations to the latest patched versions immediately
• Audit systems for vulnerable versions using software inventory tools
• Consider temporarily restricting PDF opening capabilities until patches are deployed
• Enable Protected View in Adobe Acrobat/Reader as an additional defense layer

Patch Information

Adobe has released security updates to address this vulnerability as documented in Adobe Security Bulletin APSB21-29. Organizations should update to the following minimum versions:

• Acrobat DC / Reader DC (Continuous): Update to version 2021.001.20155 or later
• Acrobat 2020 / Reader 2020 (Classic): Update to version 2020.001.30025 or later
• Acrobat 2017 / Reader 2017 (Classic): Update to version 2017.011.30196 or later

This vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, which mandates federal agencies to remediate by specified deadlines.

Workarounds

• Enable Protected View in Adobe Acrobat/Reader preferences to open potentially unsafe files in a sandboxed environment
• Configure security settings to disable JavaScript execution in PDF documents
• Use alternative PDF readers for untrusted documents until patches can be applied
• Implement application whitelisting to prevent unauthorized code execution from PDF applications

# Verify Adobe Acrobat/Reader version on Windows
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\DC\Installer" /v VersionMax

# Check installed version on macOS
defaults read /Applications/Adobe\ Acrobat\ Reader\ DC.app/Contents/Info.plist CFBundleShortVersionString