CVE-2026-47911: Adobe Acrobat Reader Out-of-Bounds Write RCE Vulnerability

Technical summary

CVE-2026-47911 is an out-of-bounds write vulnerability (CWE-787) in Adobe Acrobat Reader that enables arbitrary code execution with user-level privileges. The flaw exists in versions 24.001.30365, 26.001.21651, and earlier on both Windows and macOS platforms. The vulnerability requires a victim to open a malicious file, making it a user-interaction-dependent attack vector. The out-of-bounds write mechanism allows an attacker to overwrite adjacent memory regions, potentially corrupting data structures or injecting executable code that executes in the context of the affected user.

Business impact

For organizations relying on Acrobat Reader for document handling, this vulnerability poses a significant operational risk. Successful exploitation could lead to unauthorized code execution, data theft, lateral movement within the network, or system compromise. Remote workers and users processing untrusted documents face heightened exposure. The financial impact includes potential incident response costs, data breach notification obligations, and business disruption from infected systems.

Affected systems

Adobe Acrobat Reader versions 24.001.30365 and 26.001.21651 and earlier are vulnerable. The issue affects systems running Windows and macOS. Users of Adobe Acrobat (the full suite) may also be impacted. Organizations should inventory deployed Reader versions to determine exposure scope, as adoption of recent versions varies widely across enterprise environments.

Exploitability

While the vulnerability requires user interaction—a victim must open a malicious document—the attack surface remains broad given the ubiquity of email-based document sharing and social engineering techniques. Attackers can distribute weaponized files through phishing, drive-by downloads, or file-sharing platforms. The barrier to exploitation is relatively low; no authentication or special user privileges are required to trigger the flaw. However, as of the data provided, no evidence of active exploitation in the wild has been formally documented in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Immediately patch Adobe Acrobat Reader to the latest available version released after the vulnerability disclosure. Verify against Adobe's official security advisory for specific patch versions addressing this flaw. Additionally, enforce organizational policies requiring users to avoid opening unexpected document attachments, particularly from external senders. Consider deploying application whitelisting or content filtering to restrict execution of untrusted binaries.

Patch guidance

Check Adobe's official security advisory and product update channels for patched versions. Users should enable automatic updates in Acrobat Reader settings, or manually download and install the latest version from Adobe's website. Administrators should test patches in a non-production environment before enterprise rollout. Verify patch deployment across all Reader instances in your environment, including older devices or offline systems that may be overlooked during standard update cycles.

Detection guidance

Monitor for suspicious Acrobat Reader process behavior, including unexpected child processes, file writes to system directories, or network communications initiated from Reader. Endpoint Detection and Response (EDR) tools should flag out-of-bounds memory access attempts or code injection patterns targeting Reader. Log and alert on failed or unusual document opening attempts. Network-based detection should identify phishing emails with suspicious PDF attachments or downloads of malicious documents. File integrity monitoring can help detect unauthorized system modifications post-exploitation.

Why prioritize this

This vulnerability merits high priority due to its HIGH severity rating (CVSS 7.8), broad user base, and user-interaction requirement that maps directly to common attack vectors like phishing. The combination of arbitrary code execution capability, lack of special privileges needed to trigger the flaw, and the prevalence of Acrobat Reader across both enterprise and consumer environments creates substantial risk. Patch adoption should be accelerated to reduce the window of exposure before attackers weaponize the flaw at scale.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects high impact across confidentiality, integrity, and availability, combined with local attack vector and required user interaction. The score appropriately captures the severity of arbitrary code execution but is tempered by the need for a user to open a malicious file. This scoring aligns with the real-world threat model where phishing or social engineering must precede successful exploitation, yet the end result—full code execution in user context—is catastrophic.

Frequently asked questions