CVE-2026-47923: Adobe Acrobat Reader Out-of-Bounds Memory Read – Information Disclosure Risk

Technical summary

This out-of-bounds read vulnerability (CWE-125) in Adobe Acrobat Reader permits attackers to access memory beyond intended boundaries when processing malicious PDF or document files. By crafting a file that triggers improper bounds checking in the application, an attacker can read adjacent memory regions, potentially exfiltrating sensitive data. The attack requires user interaction—the victim must open the malicious file—making it a client-side attack vector. The vulnerability affects multiple versions across Adobe Acrobat DC, Acrobat Reader DC, and standalone Acrobat products on Windows and macOS platforms.

Business impact

Organizations relying on Adobe Reader for document workflows face a data disclosure risk. Sensitive documents processed by affected users—including contracts, financial records, or confidential communications—could expose not just file contents but also sensitive data cached in memory during document processing. For enterprises handling regulated data (healthcare, financial, legal), this creates compliance and incident response obligations. While exploitation requires user interaction, the prevalence of PDF as a document standard and the potential for targeted spear-phishing with malicious PDFs make this a realistic threat in most environments.

Affected systems

Adobe Acrobat Reader DC, Adobe Acrobat DC, and standalone Adobe Acrobat products at version 24.001.30365, 26.001.21651 and earlier are vulnerable. The issue affects both Windows and macOS systems. Users on the latest patched versions are not impacted. Organizations should verify their internal Acrobat/Reader version distribution to scope exposure.

Exploitability

Exploitability requires user interaction—a victim must open a malicious file. There is no evidence of active exploitation (the vulnerability is not on the CISA Known Exploited Vulnerabilities list), and no public exploit code is documented. However, the attack surface is broad: PDFs are ubiquitous in business communication, and social engineering or targeted phishing campaigns could reliably deliver malicious files to users. The barrier to exploitation is moderate; an attacker needs to craft a specially formed file but does not require authentication or special system access.

Remediation

Update Adobe Acrobat Reader, Acrobat DC, and Acrobat to versions after 24.001.30365 and 26.001.21651 respectively. Adobe typically releases security updates monthly; verify the exact patched version numbers against the official Adobe security advisory. For enterprises, prioritize patching on systems handling sensitive or regulated data. Consider complementary controls: educate users to avoid opening files from untrusted sources, disable automatic PDF opening in email clients, and enforce file type restrictions where feasible.

Patch guidance

Apply the latest Adobe security updates immediately for affected products. Adobe provides both auto-update and manual patch options through their Security Updates page. Organizations managing Acrobat deployments should verify patched version numbers in Adobe's official advisory to ensure builds exceed the vulnerable thresholds (24.001.30365 and 26.001.21651). Test patches in a staging environment before broad rollout to ensure compatibility with document workflows and integrations. For macOS users, verify compatibility with the OS version; for Windows, check whether EMET or other memory protections are in place (they may mitigate but do not eliminate the risk).

Detection guidance

Monitor for Adobe Acrobat/Reader crashes or unexpected memory access patterns after opening specific documents. Endpoint Detection and Response (EDR) tools can flag abnormal process memory reads, though signature-based detection of the malicious PDF construct may be limited without vendor-provided indicators. In network logs, look for suspicious outbound connections immediately following document processing—a sign of data exfiltration. Forensic analysis of crash dumps or memory forensics on affected systems may reveal memory contents that were read. Security teams should correlate Adobe update lag with user segments to identify high-risk populations still on older versions.

Why prioritize this

Although the CVSS score is 5.5 (Medium), the practical risk is elevated by the ubiquity of Adobe Reader in enterprise environments, the low barrier to user-targeted exploitation, and the sensitive nature of data that could be exposed from memory. Prioritize systems and users handling regulated or high-value data (finance, legal, healthcare divisions). The lack of active exploitation provides a window to patch without immediate emergency-level urgency, but the user-interaction requirement means that defensive user awareness alone is insufficient.

Risk score, explained

CVSS 3.1 score of 5.5 reflects a local attack vector requiring user interaction, no privilege escalation, and impact limited to confidentiality (information disclosure). No integrity or availability impact raises the severity threshold. However, the score does not account for the breadth of Acrobat's installed base, the targeting risk posed by PDF as a delivery vector, or the sensitivity of in-memory data that could be leaked. Organizations should adjust their internal risk rating upward if users regularly process sensitive documents.

Frequently asked questions