CVE-2026-47965 Adobe Reader Out-of-Bounds Write Vulnerability: Patch and Detection Guide

Technical summary

CVE-2026-47965 is an out-of-bounds write vulnerability (CWE-787) in Adobe Reader's file parsing logic. The flaw occurs when Reader processes a malicious PDF or similar document format, allowing an attacker to write data beyond the bounds of an allocated buffer. This memory corruption can be leveraged to overwrite critical control structures and achieve arbitrary code execution within the Reader process context. The CVSS 3.1 score of 7.8 (HIGH) reflects high impact across confidentiality, integrity, and availability, combined with local attack surface and required user interaction.

Business impact

A successful attack could allow threat actors to steal sensitive documents processed by targeted users, establish persistence on corporate workstations, or pivot to network resources accessible from compromised endpoints. Organizations with heavy PDF workflows—legal, financial, engineering, healthcare sectors—face elevated risk. Unpatched systems create both direct exposure and potential compliance violations if sensitive data handling is involved.

Affected systems

The vulnerability affects Adobe Acrobat and Acrobat Reader DC across Windows and macOS platforms, specifically version 24.001.30365 and earlier, as well as version 26.001.21651 and earlier. Organizations using older versions are at particular risk and should verify their current installations against these version thresholds. The issue spans both consumer and enterprise editions.

Exploitability

Exploitation requires crafting a malicious document and socially engineering a user to open it. No network access or elevated privileges are needed from the attacker. Once the file is opened, the out-of-bounds write can be triggered automatically during parsing, making it relatively straightforward for skilled attackers to weaponize. The barrier to exploitation is primarily the user interaction requirement—determined threat actors commonly bypass this through spear-phishing, watering hole attacks, or supply chain compromises.

Remediation

Adobe has released patched versions addressing this vulnerability. Organizations must upgrade Acrobat Reader to a version newer than 24.001.30365 and 26.001.21651 respectively. Verify patch availability directly from Adobe's security advisories and deploy updates across all endpoints. Until patches are applied, implement compensating controls: disable PDF preview in email clients, restrict macros and external content handling in Reader, and educate users on file-opening risks from untrusted sources.

Patch guidance

Check Adobe's official security bulletin for the specific patched version numbers applicable to your Reader variant and operating system. Adobe typically releases patches through their regular update channels and security advisories. Enable automatic updates where possible, or establish a patch deployment timeline not to exceed 30 days given the HIGH severity rating. Test patches in a non-production environment before broad rollout to ensure compatibility with critical workflows and plugins.

Detection guidance

Monitor for suspicious file access and process execution originating from Adobe Reader processes. Look for Reader spawning unexpected child processes, accessing unusual network resources, or writing to startup folders and registry run keys. Endpoint detection and response (EDR) tools should flag out-of-bounds memory writes or heap spray patterns. Network-level detection is limited due to the local exploitation nature, but suspicious PDF delivery via email or unusual document sharing patterns warrant investigation. File integrity monitoring on commonly targeted document repositories can detect unauthorized modifications.

Why prioritize this

A HIGH-severity code execution vulnerability with user interaction is a significant risk in environments where documents are routinely exchanged. While it requires social engineering, the frequency of PDF-based attacks and the ease of weaponization make this a priority for timely patching. Organizations should treat this as part of their critical infrastructure hardening, especially if they process confidential information or operate in high-value target sectors.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects the combination of high impact (confidentiality, integrity, and availability all fully compromised), local attack vector, low attack complexity, no privilege escalation required, and unchanged scope. The score is tempered only by the requirement for user interaction. For most enterprise environments with centralized patch management and security awareness training, this represents a manageable but non-trivial risk requiring prompt remediation.

Frequently asked questions