CVE-2021-28638: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2021-28638 is a Heap-based Buffer overflow vulnerability affecting Adobe Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier), and 2017.011.30197 (and earlier). The vulnerability was disclosed on August 20, 2021, and requires user interaction through opening a malicious file to be exploited (NVD, CVE).

The vulnerability is classified as a Heap-based Buffer overflow (CWE-122) with a CVSS 3.1 Base Score of 7.8 (HIGH) and vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS 2.0 Base Score is 6.8 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:P/I:P/A:P) (NVD).

An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. The successful exploitation could lead to complete compromise of the affected system, though it requires user interaction through opening a malicious file (CVE).

Adobe has released security updates to address this vulnerability through the security bulletin APSB21-51. Users should update to the latest version of Adobe Acrobat Reader DC to mitigate this vulnerability (Adobe Advisory).