CVE-2021-44701: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability
First published: Fri Jan 14 2022(Updated: )
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat | >=21.001.20149<=21.007.20099 | |
| Adobe Acrobat Reader | >=21.001.20149<=21.007.20099 | |
| Microsoft Windows | ||
| Apple iOS and macOS | ||
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30017 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30017 | |
| Adobe Acrobat Reader | >=17.011.30180<=17.011.30204 | |
| Adobe Acrobat Reader | >=17.011.30180<=17.011.30204 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2021-44701?
CVE-2021-44701 has a critical severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2021-44701?
To fix CVE-2021-44701, upgrade Adobe Acrobat Reader DC to version 21.007.20102 or later, or upgrade to newer versions of affected Acrobat products.
What software is affected by CVE-2021-44701?
CVE-2021-44701 affects Adobe Acrobat Reader DC versions 21.007.20099 and earlier, as well as versions 20.004.30017 and earlier, and 17.011.30204 and earlier.
What type of vulnerability is CVE-2021-44701?
CVE-2021-44701 is a use-after-free vulnerability that arises during the processing of Format event actions.
What are the potential impacts of CVE-2021-44701?
The potential impact of CVE-2021-44701 includes arbitrary code execution within the context of the current user.
- agent/type
- agent/weakness
- agent/author
- agent/remedy
- agent/references
- agent/description
- agent/severity
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat
- version/adobe acrobat/21.001.20149
- version/adobe acrobat/21.007.20099
- canonical/adobe acrobat reader
- version/adobe acrobat reader/21.001.20149
- version/adobe acrobat reader/21.007.20099
- vendor/microsoft
- canonical/microsoft windows
- vendor/apple
- canonical/apple ios and macos
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/20.004.30017
- version/adobe acrobat reader/17.011.30180
- version/adobe acrobat reader/17.011.30204