CVE-2026-47913: Acrobat Reader Use-After-Free Code Execution Vulnerability

Technical summary

The vulnerability is classified as a Use After Free (CWE-416) with a CVSS v3.1 score of 7.8 (HIGH). The flaw allows an attacker to trigger code execution through memory corruption when a crafted PDF file is processed by the vulnerable Acrobat Reader versions. The attack vector is local (AV:L), requires no privileges (PR:N), and depends on user interaction (UI:R). The impact is complete—the attacker can achieve confidentiality, integrity, and availability compromise in the context of the user running Acrobat Reader.

Business impact

Organizations relying on Acrobat Reader for document workflows face risk of endpoint compromise via supply-chain document delivery, social engineering attacks, or internal file sharing. A successful exploit grants the attacker the same access level as the user, potentially enabling lateral movement, data theft, or installation of persistence mechanisms. This is especially concerning for knowledge workers, legal professionals, and financial teams who regularly handle PDF documents from external parties.

Affected systems

Adobe Acrobat Reader versions 24.001.30365 and earlier, and 26.001.21651 and earlier are affected on both Windows and macOS platforms. Organizations should verify their current Acrobat Reader versions across their deployed fleet, including both perpetual and subscription-based deployments.

Exploitability

While no public exploit or KEV listing exists at this time, the vulnerability's reliance on user interaction—opening a malicious PDF—is a standard attack vector already well-established in the threat landscape. The barrier to exploitation is low; an attacker merely needs to craft a malicious PDF and deliver it through email, file sharing, or document repositories. Given Acrobat Reader's ubiquity and users' tendency to trust PDF files, this vulnerability is highly likely to be weaponized once patches are widely deployed.

Remediation

Apply the latest patched versions of Acrobat Reader released by Adobe. Verify against the official Adobe security advisory for exact version numbers and any platform-specific guidance. Until patching is complete, users should avoid opening PDF files from untrusted or unexpected sources, and organizations can consider restricting PDF opening to sandboxed environments or read-only viewers where feasible.

Patch guidance

Check Adobe's official security advisory to identify the specific patched versions for your platform and Acrobat variant (Reader, Acrobat Pro, etc.). Deploy patches through your standard software update mechanism, ensuring coverage across all endpoints where Acrobat Reader is installed. Test patches in a controlled environment before broad rollout to confirm compatibility with critical workflows. Prioritize user-facing systems and shared document repositories.

Detection guidance

Monitor for suspicious PDF file creation or modification in email attachments and shared drives. Observe for unexpected Acrobat Reader process behavior, including child process creation, network connections, or memory anomalies. Endpoint detection and response (EDR) tools should flag use-after-free exploitation patterns. Log file access attempts to PDF files that trigger unusual memory operations. Correlation of PDF opens with system crashes or privilege elevation attempts may indicate exploitation attempts.

Why prioritize this

This vulnerability merits urgent patching due to its HIGH CVSS score, achievable code execution impact, and low exploitation barriers. Acrobat Reader's prevalence in business environments combined with the commonplace nature of PDF-based social engineering makes this a prime target for both targeted and opportunistic attacks. Although KEV listing is not yet active, the attack surface is large and the user interaction requirement is easily satisfied through phishing or document supply-chain compromise.

Risk score, explained

The CVSS 7.8 score reflects high severity: local attack surface, no privilege requirement, user interaction needed, and complete compromise of confidentiality, integrity, and availability. The score appropriately balances the real-world threat (malicious PDFs are trivial to distribute) against the mitigating factor of required user action. For organizations with high email traffic or document-sharing workflows, the practical risk may trend higher than the baseline CVSS suggests.

Frequently asked questions