CVE-2026-47955: Adobe Acrobat Reader Use After Free Code Execution Vulnerability

Technical summary

CVE-2026-47955 is a Use After Free (CWE-416) memory corruption vulnerability in Adobe Acrobat Reader. This class of defect occurs when code attempts to access memory that has already been freed, which can be exploited to corrupt the heap and redirect execution flow. The vulnerability manifests in Acrobat Reader versions 24.001.30365 and 26.001.21651 or earlier. Exploitation requires user interaction—specifically, opening a malicious PDF or similar document—but once triggered, allows arbitrary code execution within the security context of the application and logged-in user. The CVSS v3.1 score of 7.8 (HIGH) reflects high impact across confidentiality, integrity, and availability, with local attack vector and no privilege escalation requirement.

Business impact

This vulnerability poses a direct risk to organizations where users frequently handle PDF documents from external or untrusted sources. Successful exploitation could lead to data exfiltration, unauthorized document modification, credential theft, and lateral movement within a network if the affected user account has elevated privileges. Industries reliant on secure document handling—legal, financial, healthcare—face heightened risk. The need for user interaction (opening a file) means social engineering or spear-phishing campaigns targeting file distribution are viable attack vectors.

Affected systems

Adobe Acrobat Reader DC and Adobe Acrobat DC are directly affected on Windows and macOS platforms in versions 24.001.30365 and 26.001.21651 or earlier. The vulnerability also impacts other Acrobat products. Both consumer and enterprise deployments of these applications are in scope. Organizations using auto-update features may have already received patches; those with deferred or manual update processes face active exposure.

Exploitability

While the vulnerability requires user interaction (opening a malicious file), this does not significantly impede real-world exploitation. Attackers can distribute malicious PDFs via email, file-sharing platforms, or compromised websites using social engineering tactics. The use-after-free condition is reliably triggerable in affected versions, and successful exploitation grants code execution at the application level. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the HIGH CVSS score and ease of weaponization mean it is attractive to threat actors. Proof-of-concept development is likely underway or complete in private threat communities.

Remediation

Adobe has released patches for affected versions. Organizations should immediately update Acrobat Reader to a patched version released after June 2026. Verify the exact patched version numbers through Adobe's official security advisory. Interim mitigation includes disabling or restricting PDF opening from untrusted sources, running Reader in a sandboxed environment if available, and blocking known malicious file hashes via endpoint protection. User awareness training on the risks of opening unsolicited attachments is essential.

Patch guidance

Consult Adobe's official security bulletin for the specific patched version numbers applicable to your deployment (e.g., Reader DC or Acrobat DC on Windows or macOS). Verify patch applicability against your current version number (compare against the vulnerable versions 24.001.30365, 26.001.21651 and earlier). Enable automatic updates where feasible; if manual patching, prioritize systems used by high-value targets such as executives, legal staff, or finance teams. Test patches in a non-production environment before enterprise rollout to ensure compatibility with existing workflows and plugins.

Detection guidance

Monitor for anomalous process behavior spawned from Acrobat Reader or Acrobat DC processes, particularly suspicious child processes, network connections, or file system modifications. Endpoint Detection and Response (EDR) solutions should flag Use After Free exploits via memory corruption signatures. Log and alert on failed or successful exploitation attempts via application crash dumps or OS-level security events. Network segmentation can limit lateral movement if Reader is compromised. Consider blocking or quarantining PDF files from high-risk sources at the email gateway. Endpoint protection signatures for this CVE should be deployed as vendors release them.

Why prioritize this

A HIGH-severity, locally-exploitable arbitrary code execution vulnerability in ubiquitous software (PDF readers are industry-standard) warrants immediate patching. The reliance on user interaction is a minor limiting factor given the prevalence of spear-phishing and social engineering. Organizations should treat this as a critical patching priority within their vulnerability management workflow, alongside other remote code execution flaws, particularly in segments where document handling is frequent.

Risk score, explained

The CVSS v3.1 score of 7.8 (HIGH) reflects the confluence of high-impact outcomes (confidentiality, integrity, availability all affected), local attack vector, low attack complexity, no privilege escalation, and required user interaction. The score appropriately captures the practical risk: while user action is needed, successful exploitation grants near-total system compromise at the application level. Organizations operating in high-security or high-trust environments should consider this a critical finding.

Frequently asked questions