CVE-2021-21017: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2021-21017 is a heap-based buffer overflow vulnerability affecting Adobe Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier). The vulnerability was discovered and disclosed in February 2021, and Adobe has confirmed that it has been exploited in limited attacks targeting Adobe Reader users on Windows (Adobe Advisory).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) that could allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. The vulnerability has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current user. The attacker could potentially gain the same rights as the compromised user, allowing them to execute malicious code, access sensitive information, or take control of the affected system (Rapid7).

Adobe has released security updates to address this vulnerability. Users are strongly advised to update to the latest version of Adobe Acrobat and Reader as per the vendor's instructions. This vulnerability has been included in CISA's Known Exploited Vulnerabilities Catalog, with federal agencies required to apply updates by November 17, 2021 (NVD).