Description


Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Related CPE's


a

adobe

acrobat_dc

2

a

adobe

acrobat_reader_dc

2

o

microsoft

windows

3

o

apple

macos

3

a

adobe

acrobat

2

a

adobe

acrobat_reader

2

Weaknesses



CWE-416

CVSS impact metrics


CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information


Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-10-15T15:15:08.817

3 years ago

Last modified

2021-10-21T21:14:00.220

3 years ago