Cyber Resilience

CVE-2021-28560

Memory Safety in Adobe Acrobat Dc 15.008.20082 – 21.001.20150

High EPSSMemory Safety
Published
02 September 2021
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.67 99.2th percentile
Risk Priority 85 floored blend · peak EPSS

Summary

CVE-2021-28560 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Acrobat Dc. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the…

more

current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CWE(s)
CWE-122

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1204.002 Malicious File Executionconfidence: HIGH
Vulnerability requires the victim to open a malicious file to trigger exploitation.
attack.mitre.org →
T1203 Exploitation for Client Execution Executionconfidence: HIGH
Heap-based buffer overflow in Acrobat Reader enables client-side code execution via a malicious file.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: MEDIUM
Arbitrary code execution in the context of the current user can lead to privilege escalation.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-21605Same product: Adobe Acrobat
CVE-2026-47952Same product: Adobe Acrobat
CVE-2021-21017Same product: Adobe Acrobat
CVE-2023-44372Same product: Adobe Acrobat
CVE-2024-39426Same product: Adobe Acrobat
CVE-2024-49535Same product: Adobe Acrobat
CVE-2023-38243Same product: Adobe Acrobat
CVE-2025-43577Same product: Adobe Acrobat
CVE-2023-21585Same product: Adobe Acrobat
CVE-2023-44360Same product: Adobe Acrobat

Affected Assets

adobe
acrobat dc
15.008.20082 — 21.001.20150 · 15.008.20082 — 21.001.20150
adobe
acrobat reader dc
15.008.20082 — 21.001.20150 · 15.008.20082 — 21.001.20150
adobe
acrobat
17.011.30059 — 17.011.30194 · 20.001.30005 — 20.001.30020
adobe
acrobat reader
17.011.30059 — 17.011.30194 · 20.001.30005 — 20.001.30020

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.4.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.

PR.PS-02 partial match
prevents

Timely patching removes known heap-overflow instances after they exist.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development and acceptance can detect heap overflows before release.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates practices that reduce the likelihood of introducing heap overflows.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify bounds-checking and safe memory APIs that mitigate heap overflows.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture and engineering principles include memory-safety and input-validation controls that address heap overflows.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prescribe techniques (safe functions, bounds checks) that prevent heap-based buffer overflows.

A.8.32 Change management none match
none

Change management ensures controlled deployment of fixes for discovered heap-overflow vulnerabilities.

References