CVE-2021-21017
Memory Safety in Adobe Acrobat 17.0 – 17.011.30188
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-21017 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Acrobat. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Acrobat Reader DC versions 2020.013.20074 and earlier, 2020.001.30018 and earlier, and 2017.011.30188 and earlier contain a heap-based buffer overflow vulnerability tracked as CVE-2021-21017 and associated with CWE-122 and CWE-787. The flaw resides in the PDF handling components of these releases and carries a CVSS 3.1 score of 8.8.
An unauthenticated attacker can exploit the issue by supplying a malicious file that triggers the overflow when opened, resulting in arbitrary code execution under the privileges of the current user. Successful exploitation therefore requires the victim to interact with the crafted document, typically delivered via email or a web page.
Adobe has published remediation guidance in security bulletin APSB21-09, and the vulnerability appears in CISA’s catalog of known exploited vulnerabilities, confirming observed in-the-wild use.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-8423
Vulnerability Data
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the…
more
current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.
Timely patching removes known heap-overflow instances after they exist.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.