---
id: "CVE-2021-21017"
kind: "vulnerability"
aliases: ["CVE-2021-21017"]
title: "Adobe Acrobat and Reader: Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.86326
exploited: true
status: "open"
category: "package"
products: [{"name": "Adobe Acrobat and Reader", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["acrobat", "exploited", "macos", "package", "reader", "windows"]
not_affected_if: ["unpatched-version-not-installed"]
published_at: "2021-02-11T20:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21017", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21017", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21017", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Adobe Acrobat and Reader: Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Adobe Acrobat and Reader have a heap-based buffer overflow that lets an attacker run code as the current user. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Acrobat and Reader affected ? fixed ?

## How to check

Open Acrobat or Reader and check Help > About to see the installed version, then compare it with the vendor's fixed release.

## Fix

Update Adobe Acrobat and Reader to the fixed version named in the vendor bulletin (fixed version not stated in sources).
Update per vendor instructions as CISA requires.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21017
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-21017
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-21017

## From the sources

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_