Actively exploited in the wild
Adobe Acrobat and Reader Use-After-Free Vulnerability
Adobe - Acrobat and Reader · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-28550
HighCVSS 8.8KEVSummary
A Use After Free vulnerability in Adobe Acrobat Reader DC affects versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier. An unauthenticated attacker could leverage this to achieve arbitrary code execution in the context of the current user, but requires user interaction to open a malicious file.
Risk Assessment
An attacker could gain control of the victim's system if they open a malicious PDF, potentially leading to data theft or malware installation.
Recommendation
Update Adobe Acrobat Reader DC to the latest available version to mitigate the vulnerability.
Other vulnerabilities in Adobe Acrobat Reader DC
Original NVD description (English source)
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.