{"id":"CVE-2021-21017","kind":"vulnerability","aliases":["CVE-2021-21017"],"related":[],"title":"Adobe Acrobat and Reader: Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability","description":"Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Acrobat and Reader have a heap-based buffer overflow that lets an attacker run code as the current user. CISA lists it as actively exploited in the wild.","severity":"high","cvss":8.8,"epss":0.86326,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Adobe Acrobat and Reader","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acrobat","exploited","macos","package","reader","windows"],"not_affected_if":["unpatched-version-not-installed"],"how_to_check":"Open Acrobat or Reader and check Help > About to see the installed version, then compare it with the vendor's fixed release.","fix":"Update Adobe Acrobat and Reader to the fixed version named in the vendor bulletin (fixed version not stated in sources).\nUpdate per vendor instructions as CISA requires.","status":"open","published_at":"2021-02-11T20:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:05+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:32:05Z","model":"claude-haiku-5-5","output":{"fix":"Update Adobe Acrobat and Reader to the fixed version named in the vendor bulletin (fixed version not stated in sources).\nUpdate per vendor instructions as CISA requires.","reach":"internet","impact":"high","summary":"Adobe Acrobat and Reader have a heap-based buffer overflow that lets an attacker run code as the current user. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["acrobat","reader","windows","macos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the logged-in user via a crafted PDF","analyst_note":"Find the fixed Adobe Acrobat/Reader version and the vendor bulletin for CVE-2021-21017 (APSB21-09) to fill in how_to_check and fix.","how_to_check":"Open Acrobat or Reader and check Help > About to see the installed version, then compare it with the vendor's fixed release.\nunknown","needs_analyst":true,"not_affected_if":["unpatched-version-not-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000489,"input_tokens":2859,"output_tokens":406,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':16A,19A '-21017':17A,20A '2017.011.30188':73C '2020.001.30018':69C '2020.013.20074':66C 'achiev':94C 'acrobat':2A,6A,22A,25B,32B,61C 'activ':56B 'adob':1A,5A,31B 'adobe':21A 'affect':77C 'and':23A 'arbitrari':95C 'attack':45B,88C 'base':11A,39B,82C 'buffer':12A,40B,83C 'cisa':52B 'code':47B,96C 'context':100C 'could':89C 'current':50B,103C 'cve':15A,18A 'dc':63C 'earlier':68C,71C,75C 'execut':97C 'exploit':26B,57B,105C 'file':120C 'heap':10A,38B,81C 'heap-bas':9A,37B,80C 'interact':111C 'issu':108C 'let':43B 'leverag':90C 'list':53B 'maco':27B 'malici':119C 'must':116C 'open':117C 'overflow':13A,41B,84C 'packag':28B 'reader':4A,8A,24A,29B,34B,62C 'requir':109C 'run':46B 'unauthent':87C 'user':51B,104C,110C 'version':64C,65C 'victim':115C 'vulner':14A,85C,92C 'wild':60B 'window':30B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-02-11T20:15:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-21017","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21017","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2021-21017","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21017","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-21017","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21017","severity":null,"published_at":"2021-02-11T20:15:13+00:00","modified_at":"2026-06-17T03:34:40+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}