CVE-2021-21028: 
Java vulnerability analysis and mitigation

CVE-2021-21028 is a Use After Free vulnerability affecting Adobe Acrobat Reader DC. The vulnerability was discovered and disclosed in February 2021, affecting multiple versions including Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier). This vulnerability allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user, though exploitation requires user interaction through opening a malicious file (NVD).

The vulnerability is classified as CWE-416 (Use After Free) with a CVSS v3.1 Base Score of 8.8 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 Base Score is 6.8 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:P/I:P/A:P). The vulnerability affects both Windows and Macintosh operating systems (NVD).

If successfully exploited, this vulnerability allows an attacker to execute arbitrary code in the context of the current user, potentially compromising the confidentiality, integrity, and availability of the affected system. The attack requires user interaction as the victim must open a malicious file (NVD).

The vulnerability can be exploited by an unauthenticated attacker remotely, though it requires user interaction. The attack complexity is considered low, making it relatively straightforward to exploit once the user interaction requirement is met (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat and Reader as detailed in the security bulletin APSB21-09 (Adobe Advisory).