CVE-2021-28550: Adobe Acrobat and Reader Use-After-Free Vulnerability

CVE-2021-28550 is a use-after-free vulnerability in Adobe Acrobat and Reader. According to CISA, an unauthenticated attacker could abuse it to achieve code execution in the context of the current user. For IT and security teams, that means a malicious PDF or related document opened by a user could lead to attacker-controlled code running with that user’s privileges, which is why prompt inventory and patching matter.

Public detail beyond the CISA summary and the CWE classification is limited here; confirm exact affected builds, fixed versions, and any configuration notes directly against the vendor advisory before acting.

How it works

This issue is classed as CWE-416 (use-after-free). In that weakness class, the application frees a block of memory but later continues to use a pointer to it. If an attacker can influence what occupies that memory afterward, they may corrupt program state or redirect execution.

In products like Acrobat and Reader, the typical abuse path for this class is a crafted document that triggers the flawed code path when the file is opened or processed. CISA states the outcome can be code execution in the context of the current user; the attacker does not need to authenticate to the application itself. Exact trigger conditions, heap layout requirements, and exploit mechanics are not provided in the given facts—treat any public proof-of-concept claims cautiously and validate behavior only in isolated lab environments against vendor guidance.

Am I affected? How to find it in your systems

Adobe Acrobat and Reader are commonly installed on end-user Windows and macOS workstations, VDI images, and sometimes on shared or kiosk systems used to view PDFs. They may also appear in automated document-processing pipelines if those pipelines shell out to the full reader rather than a headless library.

• Inventory: Query software asset management, SCCM/Intune/Jamf, or package inventories for Adobe Acrobat and Adobe Reader installations. Capture full version strings, not only major product names.
• Scope: Include user profile installs, standing administrative images, and any servers that host the desktop products for remote use. Confirm against the vendor advisory which builds are listed as affected.
• Configuration: Note whether Protected Mode, Protected View, Enhanced Security, or similar sandbox features are enabled; these do not replace patching but affect residual risk for this class of flaw.
• Telemetry: Look for unexpected child processes of AcroRd32.exe, Acrobat.exe, or equivalent binaries; crashes or faulting modules tied to PDF parsing around the time of suspicious document opens; and outbound connections initiated by the reader process shortly after a user opened an untrusted file. Absence of such signals does not prove non-exploitation.

How to remediate

Patch first. CISA’s required action is to apply updates per vendor instructions. Obtain the fixed packages from Adobe’s official channels, validate hashes or signatures per your change process, and deploy to all inventoried Acrobat and Reader instances.

• Prioritize systems that open untrusted or internet-sourced PDFs, then broader user populations, then locked-down or air-gapped images.
• After deployment, re-inventory to confirm the updated build is present and that old versions were removed or disabled.
• Hardening for this class: keep Protected Mode / Protected View / Enhanced Security enabled where business use allows; reduce the use of the full reader for automated parsing in favor of safer libraries where feasible; run users without local admin rights so post-exploitation impact stays in user context.
• Ensure endpoint detection covers common post-compromise behaviors from office document readers (process injection, unusual script hosts, credential access).

If you can't patch immediately

Compensating controls reduce—but do not eliminate—risk until the vendor update is applied.

• Segmentation and access: Limit which hosts can receive unsolicited PDFs from the internet or email gateways; quarantine or sandbox attachments at the mail or web proxy layer.
• Virtual patching / WAF: Where a reverse proxy or secure email gateway can inspect or block known malicious PDF patterns, enable vendor-supplied rules for Adobe reader vulnerabilities; confirm rule coverage with your security vendor rather than assuming it maps to this CVE.
• Feature reduction: Disable unnecessary browser plugins or preview handlers that automatically render PDFs; prefer browser-based or server-side viewers that are separately patched if they meet business needs.
• Monitoring: Heighten alerting on reader process anomalies, new persistence created by user-context processes, and lateral movement originating from workstation subnets. Retain document-open and process-creation logs long enough to support investigation.
• User guidance: Instruct staff not to open unexpected PDFs and to report crashes of Acrobat/Reader after opening attachments—without relying on awareness as a primary control.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to workstation compromise and follow-on data theft, even when ransomware use is not documented for the CVE. If you have indicators that a malicious document was opened on an unpatched system, isolate the host, preserve memory and disk evidence, rotate credentials accessible from that user context, and begin incident response per your playbooks. As a supplementary check, individuals can run a free exposure scan of their email addresses against known breach datasets to see whether their identities already appear in public breach corpora.