{"id":"CVE-2021-39843","published":"2021-09-29T15:38:10Z","modified":"2024-09-17T01:51:52Z","title":"Adobe Acrobat Reader XObject Out-of-Bound Write Vulnerability","vendor":"Adobe","product":"Acrobat Reader","tier":"core","eol":null,"affectedVersions":[{"vendor":"Adobe","product":"Acrobat Reader","versions":[">= unspecified, <= DC 2021 July",">= unspecified, <= 20.0-Classic 2021 July",">= unspecified, <= 17.0-Classic 2021 July",">= unspecified, <= None"]}],"description":{"text":"Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","provenance":"source","from":"CVE.org"},"summary":{"text":"An out-of-bounds write flaw in the XObject handling of Adobe Acrobat Reader DC lets an attacker run arbitrary code with the privileges of the current user. Exploitation requires no authentication or local access, but a victim must be tricked into opening a malicious file.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:26Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.76678,"percentile":0.99544,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://helpx.adobe.com/security/products/acrobat/apsb21-55.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-26200","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26200","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-09-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-39843","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9954"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-acrobat-reader-cwe-787"}}