CVE-2021-39843

published 2021-09-29

CVE-2021-39843: Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write…

Priority P2 60 high 7.8 CVSS 3.1

AV L AC L PR N UI R S U C H I H A H

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat	17.011.30059 – 17.011.30199	—
adobe	acrobat	20.001.30005 – 20.004.30006	—
adobe	acrobat_dc	15.008.20082 – 21.005.20058	—
adobe	acrobat_dc	15.008.20082 – 21.005.20060	—
adobe	acrobat_reader	17.011.30059 – 17.011.30199	—
adobe	acrobat_reader	20.001.30005 – 20.004.30006	—
adobe	acrobat_reader	unspecified – DC 2021 July	—
adobe	acrobat_reader_dc	15.008.20082 – 21.005.20058	—
adobe	acrobat_reader_dc	15.008.20082 – 21.005.20060	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2021-39843 is an Out-of-bounds Write vulnerability in Adobe Acrobat and Reader leading to Memory leak; exploitation requires a victim to open a malicious file, so detection should focus on suspicious PDF file opens triggering Acrobat/Reader process anomalies. ↗
• → Affected versions for Windows: Acrobat DC Continuous 2021.005.20060 and earlier, Acrobat 2020 Classic 2020.004.30006 and earlier, Acrobat 2017 Classic 2017.011.30199 and earlier — flag processes running these versions opening untrusted PDF files. ↗
• → Exploitation requires user interaction — a victim must open a malicious file; monitor for Acrobat/Reader spawning unexpected child processes or network connections after opening a PDF. ↗

• · CVE-2021-39843 affects multiple Acrobat/Reader track versions across Windows and macOS; ensure version checks cover all three tracks (DC Continuous, Classic 2020, Classic 2017) and both platforms. ↗

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787