CVE-2021-39837: Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability
First published: Wed Sep 29 2021(Updated: )
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30006 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30006 | |
| Apple iOS and macOS | ||
| Microsoft Windows | ||
| Adobe Acrobat | >=15.008.20082<=21.005.20058 | |
| Adobe Acrobat Reader | >=15.008.20082<=21.005.20058 | |
| Adobe Acrobat | >=15.008.20082<=21.005.20060 | |
| Adobe Acrobat Reader | >=15.008.20082<=21.005.20060 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30199 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30199 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2021-39837?
CVE-2021-39837 is classified as a critical severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2021-39837?
To fix CVE-2021-39837, users should upgrade to the latest version of Adobe Acrobat or Acrobat Reader that is not affected by the vulnerability.
Which versions are affected by CVE-2021-39837?
CVE-2021-39837 affects Adobe Acrobat Reader DC versions 2021.005.20060 and earlier, 2020.004.30006 and earlier, and 2017.011.30199 and earlier.
What type of vulnerability is CVE-2021-39837?
CVE-2021-39837 is a use-after-free vulnerability occurring specifically in the processing of AcroForm deleteItemAt action.
Can CVE-2021-39837 lead to data breaches?
Yes, CVE-2021-39837 can lead to data breaches as it allows attackers to execute arbitrary code within the application's context.
- agent/type
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/severity
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/20.004.30006
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows
- canonical/adobe acrobat
- version/adobe acrobat/15.008.20082
- version/adobe acrobat/21.005.20058
- version/adobe acrobat reader/15.008.20082
- version/adobe acrobat reader/21.005.20058
- version/adobe acrobat/21.005.20060
- version/adobe acrobat reader/21.005.20060
- version/adobe acrobat reader/17.011.30059
- version/adobe acrobat reader/17.011.30199