CVE-2026-47917: Acrobat Reader Use-After-Free RCE Vulnerability

Technical summary

This use-after-free vulnerability (CWE-416) arises when Acrobat Reader fails to properly manage memory references during document processing. After a memory object is freed, the application may attempt to access it again through a dangling pointer, allowing an attacker to corrupt the heap and redirect execution flow. The attack requires local file access and user interaction—the victim must open the malicious document. The vulnerability affects both Acrobat Reader DC and the broader Acrobat product line on Windows and macOS platforms.

Business impact

Exploitation could result in complete compromise of user systems and data within the affected user context. For enterprises where users regularly handle PDF documents from external sources—vendors, partners, customers—this represents a material risk vector. Attackers could gain access to sensitive documents, credentials, or use the compromised system as an entry point for lateral movement. Organizations relying on Acrobat for secure document workflows face potential data exfiltration and intellectual property theft.

Affected systems

Adobe Acrobat Reader DC (versions 24.001.30365 and earlier, and 26.001.21651 and earlier), Adobe Acrobat DC, and the broader Adobe Acrobat product line running on Windows and macOS systems. Organizations using older versions or maintaining version pinning policies should audit their deployment landscape immediately.

Exploitability

Exploitation is feasible but requires user interaction—a victim must explicitly open a malicious PDF file. There is no remote code execution pathway and no authentication bypass; the attack surface is fundamentally limited to users who can be socially engineered into opening untrusted documents. However, the prevalence of PDF attachments in phishing campaigns and the trust users place in PDF files make this a practical attack vector. This vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities catalog as of the last update.

Remediation

Adobe has released patches addressing this vulnerability. Affected users should upgrade to versions later than 24.001.30365 for the 24.x branch and later than 26.001.21651 for the 26.x branch. Verify the exact patched version numbers against the official Adobe security advisory. Organizations should prioritize patching for users who handle external or untrusted documents, and consider implementing application control policies to restrict Acrobat execution in high-risk scenarios.

Patch guidance

Check Adobe's official security bulletin for the specific patched versions for your Acrobat branch. The vulnerability affects version 24.001.30365 and earlier, and 26.001.21651 and earlier, so any version released after those branches should contain the fix. Deploy patches through your standard patch management process, prioritizing endpoints where users receive external documents. Test patches in a non-production environment first to ensure compatibility with any custom PDF workflows or plugins.

Detection guidance

Monitor for unusual Acrobat Reader process behavior, including unexpected child processes, network connections, or file system modifications initiated by the application. Implement file-based detection by scanning incoming PDF attachments for suspicious characteristics or known malicious signatures if your email gateway supports deep inspection. Endpoint detection and response (EDR) solutions should flag heap corruption attempts or memory access violations originating from Acrobat processes. Consider blocking macros and active content in PDFs at the gateway level as a defense-in-depth measure.

Why prioritize this

With a CVSS score of 7.8 (HIGH severity), this vulnerability combines high confidentiality, integrity, and availability impact with low attack complexity. While user interaction is required, the ubiquity of Acrobat in enterprise environments and the ease with which PDFs can be weaponized in phishing campaigns make this a material near-term risk. The absence of CISA KEV listing should not diminish internal prioritization; active remediation should begin within the standard patch cycle for high-severity issues.

Risk score, explained

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack requiring minimal complexity but necessitating user interaction. The HIGH severity rating accounts for complete compromise of confidentiality, integrity, and availability within the user's security context. The attack vector is local (not network-based), reducing breadth of attack surface, but the combination of high impact and low complexity justifies urgent patching.

Frequently asked questions