CVE-2021-28554: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2021-28554 is an Out-of-bounds Read vulnerability affecting Adobe Acrobat Reader DC. The vulnerability was discovered by Mark Vincent Yason working with Trend Micro Zero Day Initiative and was disclosed on June 8, 2021. The affected versions include Acrobat Reader DC versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier), and 2017.011.30196 (and earlier) (ZDI Advisory, NVD).

The vulnerability exists within the handling of relative paths and results from the lack of proper validation of user-supplied data, which can lead to a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. The successful exploitation could lead to disclosure of sensitive memory information and potential system compromise (NVD).

Adobe has issued an update to correct this vulnerability through the security bulletin APSB21-37. Users are advised to update to the latest version of Adobe Acrobat Reader DC to mitigate this vulnerability (Adobe Security Bulletin).