CVE-2021-28640: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

A Use-after-free vulnerability (CVE-2021-28640) was discovered in Adobe Acrobat Reader DC. The vulnerability affects multiple versions including 2021.005.20054 and earlier, 2020.004.30005 and earlier, and 2017.011.30197 and earlier. This security flaw was disclosed on July 29, 2021, and was discovered by security researcher o0xmuhe (Adobe Advisory, NVD).

The vulnerability is classified as a Use-After-Free (CWE-416) issue. It received a CVSS v3.1 Base Score of 7.3 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 Base Score is 6.0 (MEDIUM) with the vector (AV:N/AC:M/Au:S/C:P/I:P/A:P) (NVD).

If successfully exploited, this vulnerability could allow an authenticated attacker to achieve arbitrary code execution in the context of the current user. However, exploitation requires user interaction, specifically opening a malicious file (NVD).

The vulnerability requires user interaction for successful exploitation, as the victim must open a malicious file. The attack complexity is considered low, but it requires local access and user privileges (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat and Reader DC as detailed in the security bulletin APSB21-51 (Adobe Advisory).