CVE-2021-39837: Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39837?
CVE-2021-39837 is classified as a critical severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2021-39837?
To fix CVE-2021-39837, users should upgrade to the latest version of Adobe Acrobat or Acrobat Reader that is not affected by the vulnerability.
Which versions are affected by CVE-2021-39837?
CVE-2021-39837 affects Adobe Acrobat Reader DC versions 2021.005.20060 and earlier, 2020.004.30006 and earlier, and 2017.011.30199 and earlier.
What type of vulnerability is CVE-2021-39837?
CVE-2021-39837 is a use-after-free vulnerability occurring specifically in the processing of AcroForm deleteItemAt action.
Can CVE-2021-39837 lead to data breaches?
Yes, CVE-2021-39837 can lead to data breaches as it allows attackers to execute arbitrary code within the application's context.