CVE-2021-40728: Adobe Acrobat Reader DC Use After Free Arbitrary Code Execution
Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40728?
CVE-2021-40728 is a critical severity use-after-free vulnerability.
How do I fix CVE-2021-40728?
To fix CVE-2021-40728, update Adobe Acrobat Reader DC to the latest version available.
Which versions are affected by CVE-2021-40728?
CVE-2021-40728 affects Adobe Acrobat Reader DC versions up to 21.007.20095, among others.
What causes the CVE-2021-40728 vulnerability?
CVE-2021-40728 is caused by improper processing of the GetURL function which leads to a use-after-free condition.
Can CVE-2021-40728 be exploited remotely?
Yes, CVE-2021-40728 can potentially be exploited remotely by attackers through crafted PDF files.