8.8
CVSSv3

CVE-2021-21017

Published: 11/02/2021 Updated: 05/08/2022
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 606
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

Acrobat Reader DC versions versions 2020.013.20074 (and previous versions), 2020.001.30018 (and previous versions) and 2017.011.30188 (and previous versions) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

adobe acrobat

adobe acrobat_reader

adobe acrobat_reader_dc

adobe acrobat_dc

Vendor Advisories

Check Point Reference: CPAI-2021-1759 Date Published: 25 Jun 2023 Severity: High ...

Github Repositories

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bug :) # IA32 plugin, ver 202001320074 char * __cdecl FUN_2581894c(char *base_url,LPCSTR rel_url) { if ((base_url != (char *)0x0) && (rel_url != (LPCSTR)0x0)) { if ((*base_

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bug :) # IA32 plugin, ver 202001320074 char * __cdecl FUN_2581894c(char *base_url,LPCSTR rel_url) { if ((base_url != (char *)0x0) && (rel_url != (LPCSTR)0x0)) { if ((*base_

Recent Articles

Microsoft Patch Tuesday gaffe leads netizens to 'Microosft' typo-squatting domain
The Register • Thomas Claburn in San Francisco • 09 Feb 2021

That aside, enjoy the light load of 56 vulns in Windows and other code Rubbish software security patches responsible for a quarter of zero-days last year

Patch Tuesday For its February Patch Day, Microsoft released security advisories covering 56 CVE-assigned vulnerabilities, 11 of them rated critical. In doing so, the Windows giant managed to publish a misspelled URL on the landing page for its February updates that instead of taking visitors to the intended Microsoft Security Response Center post about API changes, pointed to msrc-blog.microosft.com, which turns out to be a typo-bait domain. It redirects visitors to a findanswersnow.net search ...