CVE-2021-39857

Adobe Acrobat Reader DC Information Disclosure via ActiveX LoadFile

State: Published
Severity: 4.3 Medium
Published: Sep 29, 2021
Updated: Apr 23, 2025
Reserved: Aug 23, 2021

Description

Adobe Acrobat Reader DC add-on for Internet Explorer versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to check for existence of local files. Exploitation of this issue requires user interaction in that a victim must visit an attacker controlled web page.

Scores

CVSS	Score	Vector	Source
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	adobe

Weaknesses

CWE-200 Information Exposure (CWE-200)

Affected Products

Product	Versions
Acrobat ReaderAdobe	DC 2021 July and earlierAffected 20.0-Classic 2021 July and earlierAffected 17.0-Classic 2021 July and earlierAffected None and earlierAffected

References

https://helpx.adobe.com/security/products/acrobat/apsb21-55.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.