CVE-2021-28636
📋 TL;DR
This vulnerability allows an attacker to execute arbitrary code on a victim's system by placing a malicious DLL in the C:/ folder and tricking the user into opening a malicious PDF file. It affects Adobe Acrobat Reader DC users with vulnerable versions. The attacker needs local folder access and user interaction to succeed.
💻 Affected Systems
- Adobe Acrobat Reader DC
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with the current user's privileges, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation or credential theft when users open malicious PDF files from untrusted sources.
If Mitigated
Limited impact with proper user training, restricted local folder access, and application sandboxing.
🎯 Exploit Status
Requires local file system access to place malicious DLL and user interaction to open malicious PDF. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.005.20055, 2020.004.30006, 2017.011.30198 or later
Vendor Advisory: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
Restart Required: Yes
Instructions:
1. Open Adobe Acrobat Reader DC. 2. Go to Help > Check for Updates. 3. Follow prompts to install latest version. 4. Restart computer after installation.
🔧 Temporary Workarounds
Restrict C:/ folder permissions
windowsPrevent unauthorized users from writing to the C:/ root directory
icacls C:\ /deny Everyone:(OI)(CI)(W)
Enable Protected View
windowsConfigure Acrobat to open untrusted files in Protected View mode
Edit > Preferences > Security (Enhanced) > Enable Protected View for all files
🧯 If You Can't Patch
- Implement strict access controls on C:/ folder to prevent unauthorized writes
- Train users to only open PDF files from trusted sources and enable Protected View
🔍 How to Verify
Check if Vulnerable:
Check Adobe Acrobat version in Help > About Adobe Acrobat Reader DCCheck Version:
wmic product where name="Adobe Acrobat Reader DC" get versionVerify Fix Applied:
Verify version is 2021.005.20055+, 2020.004.30006+, or 2017.011.30198+📡 Detection & Monitoring
Log Indicators:
- Process creation from Acrobat.exe loading unexpected DLLs from C:/
- Failed DLL load attempts from unusual locations
Network Indicators:
- Unusual outbound connections from Acrobat.exe process
SIEM Query:
Process:Acrobat.exe AND (File:C:\\*.dll OR CommandLine:*C:\\*)