CVE-2021-35985 : What You Need to Know

Adobe Acrobat Pro DC PDFLibTool Null Pointer Dereference Bug is a vulnerability affecting Acrobat Reader versions that could allow an attacker to trigger a denial-of-service attack.

Understanding CVE-2021-35985

This CVE identifies a null pointer dereference vulnerability in Adobe Acrobat Reader versions, potentially leading to a denial-of-service situation.

What is CVE-2021-35985?

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier, and 2017.011.30197 and earlier are impacted by a null pointer dereference vulnerability. Exploiting this flaw could enable an unauthenticated attacker to cause a denial-of-service by coercing user interaction to open a crafted file.

The Impact of CVE-2021-35985

The vulnerability carries a CVSS base score of 5.5 (Medium severity) with a high availability impact. Although it does not affect confidentiality or integrity directly, it demands low privileges and local access for exploitation.

Technical Details of CVE-2021-35985

This section covers specific technical aspects of CVE-2021-35985.

Vulnerability Description

The vulnerability stems from a null pointer dereference issue in Acrobat Reader, allowing an attacker to disrupt the application's functionality, resulting in a denial-of-service condition.

Affected Systems and Versions

Adobe Acrobat Reader versions up to 2021.005.20054, 2020.004.30005, and 2017.011.30197 are confirmed to be vulnerable to this flaw.

Exploitation Mechanism

To exploit this vulnerability, an attacker needs to entice a user into opening a malicious file, triggering the null pointer dereference and subsequent denial-of-service.

Mitigation and Prevention

Protecting systems from CVE-2021-35985 requires proactive measures and ongoing vigilance.

Immediate Steps to Take

Users are advised to update Acrobat Reader to the latest version available from Adobe. Exercise caution when opening files from untrusted or unknown sources to prevent exploitation.

Long-Term Security Practices

Implementing strong security practices such as regular software updates, user awareness training, and file validation can reduce the risk of successful attacks targeting this vulnerability.

Patching and Updates

Adobe has released patches addressing the null pointer dereference vulnerability in affected versions of Acrobat Reader. It is crucial to apply these updates promptly to mitigate the risk of exploitation.