CVE-2021-21034: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader DC (versions 2020.013.20074 and earlier, 2020.001.30018 and earlier, and 2017.011.30188 and earlier) is affected by an Out-of-bounds Read vulnerability. This security flaw was identified and tracked as CVE-2021-21034, with a CVSS v3.1 base score of 4.3 (Medium severity) (NVD).

The vulnerability exists within the parsing of URIs by IA32.api component. The issue stems from improper validation of user-supplied data, which can result in a read past the end of an allocated structure. The vulnerability has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating network accessibility with required user interaction (ZDI).

When successfully exploited, this vulnerability could allow an unauthenticated attacker to disclose sensitive information and potentially elevate privileges in the context of the current user. The impact is limited to information disclosure with no direct impact on system integrity or availability (NVD).

Exploitation of this vulnerability requires user interaction, specifically that a victim must open a malicious file. An attacker could potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat and Reader as detailed in the security bulletin APSB21-09 (Adobe Advisory).