CVE-2021-28546: Acrobat Reader DC Missing Support for Integrity Check
First published: Tue Feb 09 2021(Updated: )
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker could leverage this vulnerability to modify content in a certified PDF without invalidating the certification. Exploitation of this issue requires user interaction in that a victim must open the tampered file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30188 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.001.30018 | |
| Adobe Acrobat | >=15.008.20082<=20.013.20074 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30188 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.001.30018 | |
| Adobe Acrobat Reader | >=15.008.20082<=20.013.20074 | |
| Apple iOS and macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2021-28546?
CVE-2021-28546 has been rated as important due to the potential impact on the integrity of PDF documents.
How do I fix CVE-2021-28546?
To mitigate CVE-2021-28546, update Adobe Acrobat Reader DC to the latest version available.
Which Adobe products are affected by CVE-2021-28546?
CVE-2021-28546 affects specific versions of Adobe Acrobat Reader DC, Adobe Acrobat, and Adobe Acrobat Reader.
Can an unauthenticated attacker exploit CVE-2021-28546?
Yes, an unauthenticated attacker can exploit CVE-2021-28546 to modify content in a certified PDF.
What does CVE-2021-28546 lack that exposes it to a vulnerability?
CVE-2021-28546 is missing support for an integrity check, allowing modifications without invalidating the document.
- agent/type
- agent/author
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/17.011.30059
- version/adobe acrobat reader/17.011.30188
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/20.001.30018
- canonical/adobe acrobat
- version/adobe acrobat/15.008.20082
- version/adobe acrobat/20.013.20074
- version/adobe acrobat reader/15.008.20082
- version/adobe acrobat reader/20.013.20074
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows