CVE-2026-47924: Adobe Acrobat Reader Use-After-Free Memory Disclosure Vulnerability

Technical summary

CVE-2026-47924 is a use-after-free vulnerability (CWE-416) in Adobe Acrobat Reader's memory management. When a specially crafted file is processed, the application references memory that has already been freed, allowing an attacker to read the contents of that freed memory region. The vulnerability exists in Acrobat Reader DC versions through 24.001.30365 and 26.001.21651, as well as the base Acrobat product. The flaw affects Windows and macOS platforms. Successful exploitation requires user interaction—specifically, opening a malicious file—but no special privileges or network access is needed.

Business impact

This vulnerability poses a moderate but material risk to organizations where employees regularly open PDF documents from untrusted or semi-trusted sources. Affected users could have their sensitive information—including saved passwords, session tokens, or embedded document metadata—extracted from Acrobat Reader's memory without detection. For enterprises handling confidential documents, contract reviews, or financial PDFs, this creates a pathway for intellectual property theft or credential compromise. The need for user interaction limits the scope compared to exploit-without-interaction scenarios, but the prevalence of PDF workflows makes this a realistic threat vector.

Affected systems

All versions of Adobe Acrobat Reader DC up to and including 24.001.30365 and 26.001.21651 are vulnerable. The vulnerability also affects the full Acrobat product line at those version levels. Both Windows and macOS systems running these versions are in scope. Organizations should inventory all deployed instances of Acrobat Reader and Acrobat across their environment, paying particular attention to workstations where users receive external documents or PDFs from partners, customers, or the internet.

Exploitability

Exploitation difficulty is low from a technical standpoint—the attack requires only a malicious PDF file and user interaction. However, the attacker cannot predict what sensitive data will be disclosed, so successful attacks rely on probabilistic information leakage rather than guaranteed recovery of specific secrets. No active exploits have been added to the CISA Known Exploited Vulnerabilities catalog as of the last update. The impact is further constrained by the fact that memory disclosure, while serious, does not grant write access or code execution on the target system.

Remediation

Update Adobe Acrobat Reader to a version newer than 24.001.30365 or 26.001.21651. For Acrobat DC users, apply the latest security update released by Adobe following the advisory date. Organizations should prioritize patching workstations where users frequently process external documents. Until patches are deployed, user awareness training on opening unsolicited PDF files from unknown senders is recommended, though this is not a substitute for patching.

Patch guidance

Consult Adobe's official security advisories for the exact patched version numbers applicable to your deployment. Organizations using Acrobat Reader should enable automatic updates or manually deploy patches as soon as they become available. For Acrobat DC, check your deployment stream (continuous, classic, or enterprise) and apply patches accordingly. Test patches in a non-production environment before broad rollout to ensure compatibility with existing workflows and integrations.

Detection guidance

Monitor Acrobat Reader process behavior for abnormal memory access patterns or crashes following the opening of suspicious PDFs. Endpoint Detection and Response (EDR) tools should flag use-after-free exploitation attempts, which often manifest as unexpected process termination or memory corruption errors. Network detection is limited since the attack is local; focus on file integrity monitoring for document repositories and user-warning systems for files coming from external sources. Review Acrobat Reader crash logs for patterns consistent with memory corruption.

Why prioritize this

Although rated CVSS 5.5 (Medium) and not yet on the KEV catalog, this vulnerability merits rapid attention because Acrobat Reader is ubiquitously deployed, PDF processing is routine in most enterprises, and memory disclosure attacks are increasingly sophisticated. The barrier to exploitation is purely social engineering plus file delivery—no zero-click or network preconditions. Organizations handling sensitive documents should treat this with higher priority than the base CVSS score alone suggests.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector, low attack complexity, no privilege requirement, user interaction needed, and confidentiality impact only (no integrity or availability compromise). This places the vulnerability in the Medium severity band. However, the contextual risk is elevated by the prevalence of Acrobat Reader, the naturalness of opening PDF files, and the potential for chained exploitation if disclosed memory contains cryptographic keys or credentials.

Frequently asked questions