CVE-2021-39838: Adobe Acrobat Reader DC AcroForm buttonGetCaption Use-After-Free Remote Code Execution Vulnerability
First published: Wed Sep 29 2021(Updated: )
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetCaption action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30006 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30006 | |
| Apple iOS and macOS | ||
| Microsoft Windows | ||
| Adobe Acrobat | >=15.008.20082<=21.005.20058 | |
| Adobe Acrobat Reader | >=15.008.20082<=21.005.20058 | |
| Adobe Acrobat | >=15.008.20082<=21.005.20060 | |
| Adobe Acrobat Reader | >=15.008.20082<=21.005.20060 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30199 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30199 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2021-39838?
CVE-2021-39838 is rated as critical due to its potential for arbitrary code execution.
How do I fix CVE-2021-39838?
To address CVE-2021-39838, update Adobe Acrobat Reader DC to the latest version available.
Which versions of Adobe Acrobat are affected by CVE-2021-39838?
CVE-2021-39838 impacts Acrobat Reader DC versions 2021.005.20060 and earlier, 2020.004.30006 and earlier, and 2017.011.30199 and earlier.
Is CVE-2021-39838 exploitable on MacOS?
CVE-2021-39838 is specific to Adobe software and does not apply if running on MacOS without affected applications.
What are the potential consequences of CVE-2021-39838?
Exploitation of CVE-2021-39838 could result in arbitrary code execution, leading to system compromise.
- agent/type
- agent/author
- agent/references
- agent/description
- agent/weakness
- agent/severity
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/20.004.30006
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows
- canonical/adobe acrobat
- version/adobe acrobat/15.008.20082
- version/adobe acrobat/21.005.20058
- version/adobe acrobat reader/15.008.20082
- version/adobe acrobat reader/21.005.20058
- version/adobe acrobat/21.005.20060
- version/adobe acrobat reader/21.005.20060
- version/adobe acrobat reader/17.011.30059
- version/adobe acrobat reader/17.011.30199