CVE-2021-39836
published 2021-09-29CVE-2021-39836: Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free…
PriorityP359high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
68.70%
99.3th percentile
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | 17.011.30059 – 17.011.30199 | — |
| adobe | acrobat | 20.001.30005 – 20.004.30006 | — |
| adobe | acrobat_dc | 15.008.20082 – 21.005.20058 | — |
| adobe | acrobat_dc | 15.008.20082 – 21.005.20060 | — |
| adobe | acrobat_reader | 17.011.30059 – 17.011.30199 | — |
| adobe | acrobat_reader | 20.001.30005 – 20.004.30006 | — |
| adobe | acrobat_reader | unspecified – DC 2021 July | — |
| adobe | acrobat_reader_dc | 15.008.20082 – 21.005.20058 | — |
| adobe | acrobat_reader_dc | 15.008.20082 – 21.005.20060 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2021-39836 is triggered via a malicious PDF file exploiting a use-after-free in AcroForm buttonGetIcon action processing; detect suspicious PDF files opened in affected Adobe Acrobat/Reader versions that invoke buttonGetIcon actions ↗
- →Exploitation requires user interaction — a victim must open a malicious file; monitor for Adobe Acrobat/Reader processes spawning unexpected child processes or executing shellcode after opening PDF documents ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Qualys
Microsoft and Adobe Patch Tuesday (September 2021) – Microsoft 60 Vulnerabilities with 3 Critical, Adobe 61 Vulnerabilities
blogs_qualys·2021-09-14·CVSS 8.1
CVE-2021-40444 [HIGH] Microsoft and Adobe Patch Tuesday (September 2021) – Microsoft 60 Vulnerabilities with 3 Critical, Adobe 61 Vulnerabilities
## Microsoft Patch Tuesday – September 2021
Microsoft patched 60 vulnerabilities in their September 2021 Patch Tuesday release, and an additional 26 CVEs since September 1st. Among the 60 released in the September Patch Tuesday, 3 of them are rated as critical severity, one as moderate, and 56 as important.
## Critical Microsoft Vulnerabilities Patched
CVE-2021-40444 – Microsoft MSHTML Remote Code Execution Vulnerability
This vulnerability has been publicly disclosed and is known to be exploited. The vulnerability allows for remote code execution via MSHTML, a component used by Internet Explorer and Office. Microsoft also released a workaround to show how users can disable ActiveX controls in IE. The vendor has assigned a CVSSv3 base score of 8.8. It should be prioritized for patching.
Zscaler
Zscaler protects against 4 Adobe vulnerability | 9-14-2021
blogs_zscaler
Zscaler protects against 4 Adobe vulnerability | 9-14-2021
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
2021-09-29
Published