Critical 9.6Known exploited (CISA KEV)Published Sep 2, 2021

CVE-2021-28550Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution

Updated under an hour ago (Oct 26, 2026, 11:40 PM ET)

Does this affect you?

It affects Adobe Acrobat Reader and 3 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by Nov 17, 2021. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Adobe Acrobat Reader

Exploited in the last 30 days

Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS: 9.6 CRITICAL (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Added to CISA KEV Nov 3, 2021; federal remediation due Nov 17, 2021Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 51.85% (percentile 99)
Assigned by: adobe
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Adobe Acrobat Reader adobe:acrobat_reader (from the name)	from unspecified through 2020.001.30020; from unspecified through 2021.001.20150; from unspecified through 2017.011.30194; from unspecified through None	CNA record
adobe acrobat_dc adobe:acrobat_dc	from 15.008.20082 through 21.001.20150; from 15.008.20082 through 21.001.20149	NVD
adobe acrobat_reader_dc adobe:acrobat_reader_dc	from 15.008.20082 through 21.001.20150; from 15.008.20082 through 21.001.20149	NVD
adobe acrobat adobe:acrobat	from 17.011.30059 through 17.011.30194; from 20.001.30005 through 20.001.30020	NVD
adobe acrobat_reader adobe:acrobat_reader	from 17.011.30059 through 17.011.30194; from 20.001.30005 through 20.001.30020	NVD

References

References

https://helpx.adobe.com/security/products/acrobat/apsb21-29.html	release-notes, vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28550	third-party-advisory, us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.