CVE-2021-40725

HIGH

Adobe Acrobat and Reader DC < 17.011.30199, < 21.005.20058 - Use-After-Free in AcroForm Listbox Processing

Title source: llm
STIX 2.1

Description

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm listbox that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

References (2)

Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://helpx.adobe.com/security/products/acrobat/apsb21-55.html
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-21-1250/

Scores

CVSS v3 7.8
EPSS 0.0512
EPSS Percentile 91.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (4)
adobe/acrobat_dc 15.008.20082 - 21.005.20058
adobe/acrobat_dc 17.011.30059 - 17.011.30199
adobe/acrobat_reader_dc 15.008.20082 - 21.005.20058
adobe/acrobat_reader_dc 17.011.30059 - 17.011.30199
Published Oct 07, 2021
Tracked Since Feb 18, 2026