CVE-2021-40728: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability identified as CVE-2021-40728. The vulnerability was discovered in October 2021 and affects the processing of the GetURL function on a global object window (NVD, CVE).

The vulnerability is classified as a use-after-free (CWE-416) issue that could lead to arbitrary code execution in the context of the current user. The vulnerability has received a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a Base Score of 6.8 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:P/I:P/A:P) (NVD).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. The impact is considered high as it could potentially allow an attacker to execute malicious code with the same privileges as the affected user (NVD).

Adobe has addressed this vulnerability in their security bulletin APSB21-104. Users are advised to update their Adobe Acrobat and Reader installations to the latest version to protect against this vulnerability (Adobe Advisory).