CVE-2026-47916: Adobe Acrobat Reader Use-After-Free Vulnerability (7.8 HIGH)

Technical summary

CVE-2026-47916 is a use-after-free vulnerability (CWE-416) in Adobe Acrobat Reader that permits arbitrary code execution in the context of the current user. The vulnerability exists in Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier across Windows and macOS platforms. The attack surface is local; the memory safety issue is triggered when a user opens a malicious file. The CVSS 3.1 score of 7.8 (HIGH) reflects high impact across confidentiality, integrity, and availability, with low attack complexity and no privilege escalation requirement.

Business impact

Compromise of Acrobat Reader can lead to full system takeover by an attacker with the same user privileges. For organizations where PDF processing is routine—legal, financial, healthcare, and engineering sectors—this creates direct risk of data theft, ransomware installation, or lateral movement within the network. Supply chain attacks via malicious PDFs sent to employees, partners, or customers are feasible. The requirement for user interaction does not eliminate risk; it shifts it to social engineering, which remains an effective attack vector.

Affected systems

Adobe Acrobat Reader DC and Adobe Acrobat on Windows and macOS systems running versions 24.001.30365, 26.001.21651, or earlier are vulnerable. Verify exact vulnerable ranges and patch availability against Adobe's security advisory. Users of other PDF readers are not directly affected by this specific flaw, but Acrobat remains widespread in enterprise and consumer environments.

Exploitability

Exploitation requires a user to open a malicious file; no network access, authentication, or special privileges are needed from the attacker's perspective. Attack complexity is low. The barrier to weaponizing this vulnerability is moderate—an attacker must craft a file that triggers the use-after-free condition—but distribution via email, document collaboration platforms, or web downloads is straightforward. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but this does not guarantee exploit code does not exist in private use.

Remediation

Update Adobe Acrobat Reader and Acrobat to versions newer than 24.001.30365 and 26.001.21651 respectively. Consult Adobe's official security advisory to confirm the patched version numbers for your deployment. Until patches are applied, restrict the opening of unsolicited PDF files from untrusted sources and consider disabling PDF preview in email clients.

Patch guidance

Adobe has released patches to address this vulnerability. Confirm the patched version numbers from Adobe's official security advisory corresponding to your currently deployed version. Test patches in a non-production environment before broad rollout to ensure compatibility with internal document workflows and integrations. Prioritize systems used by high-risk roles (finance, legal, executive) who are frequent targets for spear-phishing with malicious attachments. Acrobat Reader auto-update should be enabled; verify it is active in your environment.

Detection guidance

Monitor for unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, unusual network connections initiated from these processes, and suspicious file modifications following PDF opening events. Endpoint detection and response (EDR) tools should flag use-after-free exploitation attempts through memory access violations and heap corruption signals. Review email gateway logs for PDFs from external senders opened by users. Consider blocking execution of PDFs from untrusted zones via Windows Defender Application Guard or similar sandboxing. Log and alert on attempts to disable Acrobat Reader's auto-update feature.

Why prioritize this

HIGH severity, local attack surface, and widespread use of Acrobat Reader in enterprise environments make this a priority for patching. The requirement for user interaction is the main limiting factor, but social engineering remains reliable. Organizations handling sensitive documents should treat this as urgent. The lack of KEV designation does not diminish risk; it reflects current exploitation status, not vulnerability severity.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) is driven by high impact on all three pillars—confidentiality, integrity, and availability—combined with low attack complexity and no privilege escalation requirement. The user interaction requirement reduces the overall score from critical, but the consequences of successful exploitation (arbitrary code execution as the user) are severe. For organizations where Acrobat is mission-critical, this score should be treated as a lower bound; business context may elevate local risk.

Frequently asked questions