CVE-2021-40728

Severity CVSS v4.0:
Pending analysis
Type:
CWE-416 Use After Free
Publication date:
15/10/2021
Last modified:
21/10/2021

Description

Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* 15.008.20082 (including) 21.007.20095 (including)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* 15.008.20082 (including) 21.007.20095 (including)
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* 15.008.20082 (including) 21.007.20096 (including)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* 15.008.20082 (including) 21.007.20096 (including)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* 20.001.30005 (including) 20.004.30015 (including)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* 20.001.30005 (including) 20.004.30015 (including)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* 17.011.30158 (including) 17.011.30202 (including)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* 17.011.30158 (including) 17.011.30202 (including)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*


References to Advisories, Solutions, and Tools