CVE-2021-21060: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Pro DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper input validation vulnerability identified as CVE-2021-21060. The vulnerability was discovered and disclosed in February 2021, affecting multiple versions of Adobe Acrobat and Reader on both Windows and macOS platforms (Adobe Advisory).

The vulnerability is classified as an improper input validation issue (CWE-20). It has received a CVSS v3.1 Base Score of 4.6 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L. The CVSS v2.0 Base Score is 4.3 (Medium) with the vector (AV:N/AC:M/Au:N/C:P/I:N/A:N) (NVD).

An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. The exploitation requires user interaction, specifically requiring a victim to open a malicious file (CVE).

The vulnerability requires user interaction for successful exploitation, as victims must open a malicious file. The attack complexity is considered medium according to the CVSS scoring, indicating some specific conditions need to be met for successful exploitation (NVD).

Adobe has released security updates to address this vulnerability. Users should update to the latest versions of Adobe Acrobat and Reader. The fix is available through Adobe's security bulletin APSB21-09 (Adobe Advisory).