CVE-2021-39863

Adobe Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 13.2% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat 2017 Acrobat Dc and 5 more

CVE-2021-39861

Adobe Acrobat Reader DC Catalog Plugin Out-of-Bounds Read Bug

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat 2017 Acrobat Dc and 5 more

CVE-2021-39860

Adobe Acrobat Reader DC Search Plugin Null Pointer Dereference

Acrobat Pro DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive user memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39859

Use After Free Adobe Acrobat Pro DC [HB-21-0339]

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39858

Adobe Acrobat Pro DC PostScript File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.0 · 3.3 Low EPSS 2.5% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat 2017 Acrobat Dc and 5 more

CVE-2021-39856

Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via LoadFile

Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must visit an attacker controlled web page.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39855

Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via src Parameter

Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39854

Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.0 · 5.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39853

Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39852

Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39851

Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39850

Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39849

Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39846

Adobe Acrobat Reader /Parent Property Recursive Stack Overflow

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted PDF file, potentially resulting in memory corruption in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted PDF file in Acrobat Reader.

CVSS 3.1 · 6.1 Medium EPSS 2.6% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39845

Adobe Acrobat Reader Page Tree Node Recursive Stack Overflow

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted PDF file, potentially resulting in memory corruption in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted PDF file in Acrobat Reader.

CVSS 3.1 · 6.1 Medium EPSS 2.6% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39844

Adobe Acrobat Reader CalRGB Out-of-Bounds Read Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 3.3 Low EPSS 3.1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39843

Adobe Acrobat Reader XObject Out-of-Bound Write Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 76.7% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39842

Adobe Acrobat Reader DC messageHandler.OnMessage Use-After-Free Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.0 · 7.8 High EPSS 17.4% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39841

Adobe Acrobat Pro DC DocMedia Type Confusion Remote Code Execution Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Type Confusion vulnerability. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.0 · 7.8 High EPSS 11.7% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-39840

Adobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForms that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

CVSS 3.0 · 7.8 High EPSS 60.8% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more