EUVD-2026-35809
GHSA-xhch-6vq5-g6rw
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader 24.001.30365, 26.001.21651, and earlier versions occurs through a use-after-free condition triggered when a victim opens a malicious PDF file. Successful exploitation runs attacker-supplied code with the privileges of the current user, making this a viable phishing and drive-by document attack vector. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Technical ContextAI
Acrobat Reader is Adobe's PDF rendering client, which parses a complex document format including JavaScript, embedded fonts, images, and form objects. The root cause is CWE-416 (Use After Free), a memory-safety defect in which Reader continues to reference a heap object after it has been freed, allowing an attacker to control the contents at that address by influencing the heap layout via crafted PDF objects. Use-after-free flaws in PDF parsers historically yield reliable arbitrary code execution because the format gives attackers many primitives (streams, JavaScript, object allocations) to groom the heap. The CPE string cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* indicates the entire Acrobat Reader product line is in scope up through the listed versions.
RemediationAI
Apply the updates listed in Adobe security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html), which supersedes the vulnerable 24.001.30365 and 26.001.21651 builds; exact fix versions should be taken directly from that advisory rather than inferred. Until patching is complete, mitigations include enabling Protected View and Protected Mode (sandbox) in Reader preferences to constrain code execution, disabling JavaScript in Acrobat (Preferences > JavaScript) which removes a common heap-grooming primitive at the cost of breaking interactive forms, and using email gateway or EDR rules to detonate or strip PDFs from untrusted senders. Organizations can also redirect PDF handling to a hardened viewer or browser-based renderer for external attachments, accepting reduced fidelity for Acrobat-specific features.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today