cbcvebase.
CVE-2021-39836
published 2021-09-29

CVE-2021-39836: Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free…

PriorityP359high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
68.70%
99.3th percentile
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected

9 ranges
VendorProductVersion rangeFixed in
adobeacrobat17.011.30059 – 17.011.30199
adobeacrobat20.001.30005 – 20.004.30006
adobeacrobat_dc15.008.20082 – 21.005.20058
adobeacrobat_dc15.008.20082 – 21.005.20060
adobeacrobat_reader17.011.30059 – 17.011.30199
adobeacrobat_reader20.001.30005 – 20.004.30006
adobeacrobat_readerunspecified – DC 2021 July
adobeacrobat_reader_dc15.008.20082 – 21.005.20058
adobeacrobat_reader_dc15.008.20082 – 21.005.20060

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2021-39836 is triggered via a malicious PDF file exploiting a use-after-free in AcroForm buttonGetIcon action processing; detect suspicious PDF files opened in affected Adobe Acrobat/Reader versions that invoke buttonGetIcon actions
  • Exploitation requires user interaction — a victim must open a malicious file; monitor for Adobe Acrobat/Reader processes spawning unexpected child processes or executing shellcode after opening PDF documents

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.