Heap Buffer Overflow in Adobe Acrobat & Reader (CVE‑2021‑21017) Enables Unauthenticated Code Execution
What It Is — Adobe Acrobat and Reader contain a heap‑based buffer overflow that allows an unauthenticated attacker to execute arbitrary code in the context of the current user.
Exploitability — The flaw is rated CVSS 3.1 8.8 (High). Public proof‑of‑concept code exists and the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Affected Products — Adobe Acrobat DC (2020‑2022 releases) and Adobe Reader DC (2020‑2022 releases) on Windows, macOS, and Linux.
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrating a disciplined patch‑management process is a core control that maps to multiple frameworks (e.g., NIST CSF Identify and Protect).
- Audit Evidence – Continuous collection of remediation evidence (patch version, deployment timestamps) provides defensible proof for auditors and enterprise buyers.
- Supply‑Chain Assurance – Many organizations embed PDFs from third parties; an unpatched reader becomes a vector for supply‑chain compromise, challenging the organization’s overall risk posture.
Recommended Actions
- Verify the exact Acrobat/Reader version across all endpoints.
- Deploy Adobe’s security update 2022‑001 (or later) immediately.
- Update asset‑inventory and vulnerability‑management tools to flag CVE‑2021‑21017 as a high‑priority item.
- Capture remediation tickets, patch‑deployment logs, and verification screenshots as audit‑ready evidence.
- Review and tighten application‑allow‑list policies to restrict execution of untrusted PDFs.
Source: CISA KEV – CVE‑2021‑21017