CVE-2021-39863 is a buffer overflow vulnerability in Adobe Acrobat Reader DC (multiple versions) that allows an unauthenticated attacker to achieve arbitrary code execution by tricking a user into opening a specially crafted PDF file. The vulnerability has a CVSS score of 7.8 (High), indicating a significant risk, as it can lead to full compromise of confidentiality, integrity, and availability with low attack complexity, though user interaction is required. Despite its high severity, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is it listed in CISA's KEV catalog, suggesting it is not actively exploited in the wild. Community discussion and media coverage are also minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 15.008.20082, <= 21.005.20060CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* | ||
>= 15.008.20082, <= 21.005.20058CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* | ||
>= 15.008.20082, <= 21.005.20060CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* | ||
>= 20.001.30005, <= 20.004.30006CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* | ||
>= 20.001.30005, <= 20.004.30006CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.