CVE-2021-28546

—

CVSS 3.1

6.5 medium

EPSS

1%p71

Published

Apr 1, 2021 (Apr 1, 2021)

Modified

Jun 17, 2026

Description

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker could leverage this vulnerability to modify content in a certified PDF without invalidating the certification. Exploitation of this issue requires user interaction in that a victim must open the tampered file.

Vendors: adobe
Products: acrobat, acrobat dc, acrobat reader, acrobat reader dc
Weakness: CWE-353
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news2 stories

These 2 attacks allow to alter certified PDF Documents

Security AffairsMay 30, 14:33 UTC · May 30, 2021Vulnerability CVE-2020-35931 CVE-2021-28545 CVE-2021-28546+1 CVEs

Researchers Demonstrate 2 New Hacks to Modify Certified PDF Documents

The Hacker NewsMay 29, 08:34 UTC · May 29, 2021Vulnerability CVE-2021-28545 CVE-2021-28546 CVE-2020-35931+1 CVEs