Use‑After‑Free in Adobe Acrobat & Reader (CVE‑2021‑28550) Enables Unauthenticated Code Execution
What It Is — Adobe Acrobat and Adobe Reader contain a use‑after‑free memory error that can be triggered by a specially crafted PDF. The flaw allows an unauthenticated attacker to execute arbitrary code in the context of the currently logged‑in user.
Exploitability — Public proof‑of‑concept code has been released; the vulnerability carries a CVSS 3.1 base score of 8.8 (High). No known active ransomware or widespread campaign is linked, but exploitation is technically feasible on any unpatched system.
Affected Products — All Adobe Acrobat and Adobe Reader versions prior to the security update released on June 15 2021 (including Acrobat DC 2020.x and Reader DC 2020.x).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous patch‑management monitoring as evidence of a robust configuration‑control process.
- Provides a concrete audit artifact: documented remediation dates satisfy control objectives around software integrity and vulnerability remediation across multiple frameworks.
- Highlights the importance of endpoint‑level evidence collection to prove that critical applications are kept up‑to‑date, a key trust signal for enterprise buyers.
Recommended Actions
- Deploy Adobe’s June 2021 security update (or later) to all workstations and servers running Acrobat/Reader.
- Verify patch rollout through a centralized asset inventory and capture deployment logs as control evidence.
- Update your configuration‑management policy to require a maximum 30‑day window for critical vendor patches.
- Conduct a targeted scan for the CVE‑2021‑28550 indicator of compromise on high‑value endpoints.
Source: CISA KEV – CVE‑2021‑28550