EUVD-2026-105255
GHSA-rcgg-m89p-6hx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF file
-
DeliveryDeliver via phishing email or web link
-
ExploitVictim opens file in Edge
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted malicious file (a PDF) in the Acrobat-based PDF engine of Microsoft Edge, which is the default PDF handler in Edge - so no non-default configuration is needed. The decisive limiting factor is mandatory user interaction (UI:R): the attacker cannot trigger the flaw remotely without the user opening the document, and successful code execution is confined to the current user's privilege level (S:U, no privilege escalation). No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L) once the file is opened. |
| Impact | This is a credible, prioritize-for-patching issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes an unauthenticated, low-complexity memory-corruption flaw (CWE-787 out-of-bounds write) yielding full code execution in the current user's context, offset only by the required user interaction (opening a malicious file). Several real-world signals that would elevate this are MISSING from the provided data: no EPSS probability was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so by the precision rules this is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description: AV:N is consistent with a malicious file delivered over the network and opened locally, and UI:R correctly reflects the stated requirement that a victim open the file. Net assessment: a genuinely dangerous client-side RCE in a browser PDF component with a very broad install base, but exploitation depends on social engineering and there is currently no evidence of active or automated exploitation, so it ranks below internet-facing unauthenticated RCEs that require no interaction. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF that triggers the out-of-bounds write in the Acrobat-based PDF engine in Microsoft Edge and delivers it via phishing email or a drive-by web link. When the victim opens the document in Edge, the corruption is triggered and arbitrary code runs with the victim's privileges. No public exploit code is referenced in the available data, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Out-of-bounds write in Adobe Acrobat for Edge can lead to arbitrary code execution in the context of the current user when a victim opens a crafted PDF. The flaw is remotely reachable with low attack complexity and no attacker authentication, but it requires user interaction and does not by itself elevate privileges beyond the current user. No public exploit code has been identified at time of analysis, though the high CVSS score and Edge default PDF-handler exposure make prompt patching advisable.
RemediationAI
Apply the Microsoft MSRC update guidance for CVE-2026-100134 and update Edge/Acrobat for Edge through the appropriate Microsoft or Adobe update channel; no exact fixed version is specified in the supplied data, so verify the remediated build against the MSRC advisory. Until a fixed build is confirmed, reduce exposure by configuring Edge to download PDFs instead of opening them in the built-in Acrobat engine, disabling Acrobat PDF integration through enterprise policy where it is not required, and warning users not to open unexpected PDF attachments. These controls trade away in-browser PDF rendering, forms, and annotation convenience and do not fix the underlying memory-corruption flaw, so they should be treated as temporary compensating measures rather than a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Adobe Acrobat for Edge, the Acrobat-based PDF engine used by Microsoft Edge, with the supplied CPE cpe:2.3:a:adobe:acrobat_for_edge:*:*:*:*:*:*:*:* indicating all Acrobat for Edge versions in the data rather than a bounded version range. CWE-787 describes an out-of-bounds write: the software writes data past the end of an allocated buffer, corrupting memory. In a PDF renderer/parser, that corruption can be shaped into arbitrary code execution in the current user's process when the malicious document is opened. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms network-reachable, low-complexity exploitation requiring user interaction and no attacker privileges, with unchanged scope and code execution confined to the current user's privilege level.
Know when Acrobat For Edge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file is delivered remotely (AV:N) but requires the victim to open it (UI:R); no attacker auth (PR:N), low complexity (AC:L), and memory-corruption RCE gives full C/I/A in the user's context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Acrobat for Edge is exposed to a high-severity out-of-bounds write (CVE-2026-100134) that could allow a crafted PDF to execute code as the signed-in user, affecting anyone who opens such a file through Edge’s default PDF handling. No public exploit has been identified at time of analysis and no vendor-released patch has been identified, so leadership should treat this as an urgent endpoint and email/web hygiene risk requiring interim controls rather than an immediate enterprise-wide compromise.
No vendor-released patch identified at time of analysis; disable or restrict Adobe Acrobat for Edge where feasible, force untrusted PDFs into a sandboxed or alternate viewer, block PDF attachments at email/web gateways, apply application control, and monitor Acrobat/Edge process behavior with EDR.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB