CVE-2021-28634: adobe acrobat_dc OS Command Injection

Vulnerability summary

CVE-2021-28634 is a high (CVSS 8.5) OS Command Injection vulnerability in adobe acrobat_dc. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.3% of scored vulnerabilities.

Timeline

1. 20-08-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution on the host machine in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.