Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 11, 2021 · Catalog

   Detected

   Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Nov 17, 2021 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope

Affected

• cpe adobe/acrobatversion unspecified
• cpe adobe/acrobat dcversion unspecified
• cpe adobe/acrobat readerversion unspecified
• cpe adobe/acrobat reader dcversion unspecified
• vendor Adobe Acrobat and Readerversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2021-21017

  Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

  cisa.gov
• CVE.orgVulnerability recordCVE-2021-21017

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2021-21017

  30-day exploitation probability 86.3%

  first.org
• NIST NVDVulnerability recordCVE-2021-21017

  Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code exec

  nvd.nist.gov

References

• Vendor Advisory · helpx.adobe.com
• CISA note · nvd.nist.gov
• Third Party Advisory · cisa.gov