{"id":"CVE-2021-21017","published":"2021-02-11T20:15:13Z","modified":"2026-06-17T03:34:40Z","title":"Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability","vendor":"Adobe","product":"Acrobat and Reader","tier":"core","eol":null,"description":{"text":"Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","provenance":"source","from":"NVD"},"summary":{"text":"A heap-based buffer overflow in the Acrobat and Reader products, affecting the Adobe Acrobat Reader DC component of those products. An unauthenticated attacker over the network can achieve arbitrary code execution in the context of the current user, but only if a victim is induced to open a malicious file.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:27Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.86326,"percentile":0.99733,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21017","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-02-09","exploitedFirstSeen":"2021-02-09","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2021-02-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://helpx.adobe.com/security/products/acrobat/apsb21-09.html","tags":["Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/acrobat/apsb21-09.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21017","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This exploit requires a user to open a malicious file. It can then result in execution of arbitrary code which could have any number of impacts.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-8423","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-8423","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2021-02-26","earliestUrl":"https://github.com/ZeusBox/CVE-2021-21017","repos":[{"name":"ZeusBox/CVE-2021-21017","url":"https://github.com/ZeusBox/CVE-2021-21017","stars":44,"created":"2021-02-26"}]},"first":{"date":"2021-02-26","source":"PoC-in-GitHub","url":"https://github.com/ZeusBox/CVE-2021-21017"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"source"}],"timeline":[{"date":"2021-02-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2021-02-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21017","provenance":"source"},{"date":"2021-02-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ZeusBox/CVE-2021-21017","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-8423","provenance":"source"}],"speed":{"daysToPublicExploit":15,"firstExploitFrom":"PoC-in-GitHub","daysToKev":265},"priority":{"score":69.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2088 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-acrobat-reader-cwe-787"}}