CVE-2021-28631: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader DC (versions 2021.001.20155 and earlier, 2020.001.30025 and earlier, and 2017.011.30196 and earlier) was affected by a Use After Free vulnerability. The vulnerability was discovered and reported on April 14, 2021, and was publicly disclosed on June 10, 2021 (ZDI Advisory, Adobe Advisory).

The vulnerability exists within the handling of AcroForm fields and results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is tracked as CWE-416 (Use After Free) (ZDI Advisory, NVD).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current user. The exploitation could lead to complete system compromise, potentially allowing attackers to gain the same privileges as the compromised user (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users should update to the latest version of Adobe Acrobat Reader DC. The fix was included in Adobe's security bulletin APSB21-37 (Adobe Advisory).