CVE-2021-28564 : Exploit Details and Defense Strategies

Adobe Acrobat Reader versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier are impacted by an Out-of-bounds Write vulnerability in the ImageTool component, potentially leading to arbitrary code execution.

Understanding CVE-2021-28564

This CVE affects Adobe Acrobat Reader, potentially allowing an attacker to execute arbitrary code.

What is CVE-2021-28564?

Adobe Acrobat Reader versions are vulnerable to an Out-of-bounds Write exploit in the ImageTool component, enabling attackers to execute arbitrary code with user privileges.

The Impact of CVE-2021-28564

The vulnerability poses a high severity risk with a CVSS base score of 8.8, potentially leading to arbitrary code execution, compromising user confidentiality, integrity, and availability.

Technical Details of CVE-2021-28564

Adobe Acrobat Reader versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier are affected by an Out-of-bounds Write vulnerability in the ImageTool component.

Vulnerability Description

The vulnerability allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user by leveraging an Out-of-bounds Write issue.

Affected Systems and Versions

Acrobat Reader versions prior to 2021.001.20150, 2020.001.30020, and 2017.011.30194 are vulnerable to this exploit.

Exploitation Mechanism

Exploiting this vulnerability requires user interaction, where a victim needs to open a malicious file to trigger the arbitrary code execution.

Mitigation and Prevention

Take immediate steps to mitigate the risk posed by CVE-2021-28564.

Immediate Steps to Take

Users should update Acrobat Reader to the latest version and avoid opening untrusted or malicious files.

Long-Term Security Practices

Maintain updated software, employ security best practices, and be cautious when interacting with files from untrusted sources.

Patching and Updates

Refer to Adobe's security advisory (https://helpx.adobe.com/security/products/acrobat/apsb21-29.html) for patches and updates to address CVE-2021-28564.