Adobe has released security updates to address Out-of-Bounds Read, Out-of-Bounds Write, Type Confusion, use-after-free and Heap Overflow vulnerabilities. Among the vulnerabilities patched by Adobe, CVE-2021-28550 is a zero-day that needs immediate attention.
CVE-2021-28550 is a Remote Code Execution vulnerability impacting Adobe Acrobat and Reader, and is being actively exploited in the wild on Windows devices. Adversaries can execute arbitrary code in Windows, including installing malicious applications and gaining complete access to target machines. Adobe has received a report that CVE-2021-28550 has been exploited in the wild in limited attacks targeting Adobe Reader users on Windows. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Affected devices
Adobe Acrobat and Reader
Mitigations
Adobe recommends users to update their software installations to the latest versions. For further updates, check Adobe advisory.
Qualys Detection
Qualys customers can scan their network with QID 375547 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage on latest vulnerabilities.
References and Sources
https://helpx.adobe.com/security/products/acrobat/apsb21-29.html
