⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● Critical · CVSS 9.6 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2021-28550: Adobe Acrobat and Reader Use-After-Free RCE

*By Sai Kiran Pandrala*

⚡ At a glance
SeverityCVSS 9.6 — Critical
Actively exploited?Yes, listed in CISA KEV
AffectedAcrobat Reader DC 2021.001.20150 and earlier, Acrobat DC 2021.001.20150 and earlier, Acrobat Reader 2020 2020.001.30020 and earlier, Acrobat 2017 17.011.30190 and earlier
Fixed inUpdates per Adobe APSB21-29, plus all subsequent Acrobat / Reader releases
Type (CWE)Use-After-Free

⚠️ Update Acrobat Reader / Acrobat Pro across your fleet. Phishing attachments with malicious PDFs use this CVE to drop payloads.

What is CVE-2021-28550?

Acrobat and Acrobat Reader have a use-after-free vulnerability in PDF processing. Opening a crafted PDF triggers the UAF and lets the attacker execute arbitrary code in the user context. This is the classic "open the attached invoice.pdf and your machine is owned" pattern.

Am I affected?

You are affected if you run any version below the patched Acrobat / Reader release. Check the running version: Help → About Acrobat / About Adobe Acrobat Reader.

How to fix CVE-2021-28550

  1. For end-user fleets: deploy the current Acrobat / Reader version via your endpoint management platform (Intune, JAMF, SCCM, Workspace ONE). The fix is in every cumulative update from May 2021 onward.
  2. For individual users: Acrobat Reader → Help → Check for Updates. Install the cumulative update and restart Reader.
  3. For Acrobat Pro / Standard licensed seats: Adobe's Creative Cloud client manages updates; ensure auto-update is enabled, then run "Check for Updates" from within Acrobat.

Patch via your OS package manager


# The exact package name and patched version are listed in the vendor advisory:
# https://helpx.adobe.com/security/products/acrobat/apsb21-29.html
# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade acrobatreader

# RHEL / Rocky / AlmaLinux / Fedora
sudo dnf upgrade acrobatreader

# openSUSE
sudo zypper update acrobatreader

# Verify the running version matches the fixed version
dpkg -s acrobatreader 2>/dev/null | grep -i version || rpm -q acrobatreader 2>/dev/null


# Windows: pull the cumulative update that ships this fix.
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

Verify the fix landed


# 1. Confirm the running version matches the fixed-in version from the advisory:
#    https://helpx.adobe.com/security/products/acrobat/apsb21-29.html
#    Use the platform-specific version probe above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag CVE-2021-28550 on the patched target.

# 3. Inspect recent service / kernel logs for crash loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

If you can't patch immediately

How to verify the fix worked

Help → About shows a version at or above the patched release. Use endpoint management reporting to confirm fleet-wide compliance.

Frequently asked questions

Is CVE-2021-28550 actively exploited?

Yes. CVE-2021-28550 is on the CISA Known Exploited Vulnerabilities catalog, so federal civilian agencies are required to patch on the published deadline. Most enterprises treat the same date as the practical floor.

What is the CVSS severity of CVE-2021-28550?

Critical. See the advisory for the full CVSS vector.

Where can I read the official advisory?

See https://helpx.adobe.com/security/products/acrobat/apsb21-29.html

Does the patch require a reboot?

It depends on the deployment. Service-only updates usually need a service restart; OS-level fixes require a full reboot. Check the vendor release notes for the exact post-upgrade steps.

References

*This guide was assembled from Adobe APSB21-29, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against Adobe's bulletin before applying changes in production.*

Other vulnerabilities in the same area that are worth patching alongside this one: