CVE-2026-47921: Adobe Acrobat Reader Use-After-Free Code Execution Vulnerability

Technical summary

The vulnerability is a use-after-free (CWE-416) condition in Acrobat Reader's memory management. When processing specially crafted input, the application references memory that has already been freed, allowing an attacker to overwrite that region with malicious code or data structures. Upon execution of the freed memory, arbitrary code runs in the current user's security context. The vulnerability affects both Acrobat DC and Acrobat Reader DC on Windows and macOS platforms.

Business impact

Successful exploitation enables attackers to steal sensitive documents, deploy malware, establish persistence, or pivot to corporate networks. Since Acrobat is a primary vector for document-based attacks and many users process documents without hesitation, this vulnerability poses significant risk to confidentiality, integrity, and availability. Organizations relying on Acrobat for handling sensitive contracts, financial records, or intellectual property face direct exposure.

Affected systems

Adobe Acrobat DC, Adobe Acrobat Reader DC, and earlier versions up to the stated cutoffs are affected on both Windows and macOS. Verify your installed version against vendor advisories to determine exposure. Note that the vulnerability requires the vulnerable Acrobat application itself; the underlying OS (Windows, macOS) is not the root cause but is the execution platform.

Exploitability

This vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last modification date. However, the attack surface is broad because it requires only user interaction—no special privileges, no network access, and no complex configuration. The barrier to exploitation is low for attackers who can distribute a malicious file. Phishing campaigns, compromised document repositories, or supply-chain attacks are plausible delivery mechanisms.

Remediation

Update Acrobat Reader and Acrobat DC to versions newer than 24.001.30365 and 26.001.21651 respectively. Adobe will release patched versions; consult the Adobe Security Bulletin for exact build numbers and availability. Deploy updates via your software management tools as soon as patches are available. For users unable to immediately patch, reduce exposure by disabling unnecessary file preview features and educating staff on suspicious file sources.

Patch guidance

Prioritize patching this vulnerability given its HIGH severity rating and the broad user base exposed to Acrobat Reader. Adobe typically delivers updates through the built-in update mechanism; configure automatic updates if not already enabled. Test patches in a controlled environment before enterprise rollout to rule out compatibility issues with custom PDFs or plugins. Verify patched version numbers match the official Adobe advisory before considering systems remediated.

Detection guidance

Monitor for unusual Acrobat/Reader process behavior—abnormal child processes, unexpected network connections, or file system modifications following document opens. Endpoint detection and response (EDR) tools can flag suspicious memory access patterns or code execution originating from the Acrobat process. Network-level detection is limited since the vulnerability is local; focus on behavioral analytics and application-level telemetry. Logs indicating failed or attempted Adobe updates may reveal unpatched systems.

Why prioritize this

This is a HIGH-severity local code execution vulnerability in a ubiquitous application that requires only user interaction, not network access or special privileges. The combination of broad software deployment, low exploitation barriers, and the data sensitivity of documents processed by Acrobat makes this a near-term risk. Organizations should treat this as urgent and allocate resources to patch within days, not weeks.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects high impact (confidentiality, integrity, and availability all marked as high), local attack vector, and requirement for user interaction. The score appropriately captures that while exploitation requires social engineering, the consequences are severe—full arbitrary code execution in the user's context. The vulnerability does not currently appear in the KEV catalog, but organizations should not delay patching pending active exploit detection.

Frequently asked questions