EUVD-2026-35809
GHSA-xhch-6vq5-g6rw
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader 24.001.30365, 26.001.21651, and earlier versions occurs through a use-after-free condition triggered when a victim opens a malicious PDF file. Successful exploitation runs attacker-supplied code with the privileges of the current user, making this a viable phishing and drive-by document attack vector. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Technical ContextAI
Acrobat Reader is Adobe's PDF rendering client, which parses a complex document format including JavaScript, embedded fonts, images, and form objects. The root cause is CWE-416 (Use After Free), a memory-safety defect in which Reader continues to reference a heap object after it has been freed, allowing an attacker to control the contents at that address by influencing the heap layout via crafted PDF objects. Use-after-free flaws in PDF parsers historically yield reliable arbitrary code execution because the format gives attackers many primitives (streams, JavaScript, object allocations) to groom the heap. The CPE string cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* indicates the entire Acrobat Reader product line is in scope up through the listed versions.
RemediationAI
Apply the updates listed in Adobe security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html), which supersedes the vulnerable 24.001.30365 and 26.001.21651 builds; exact fix versions should be taken directly from that advisory rather than inferred. Until patching is complete, mitigations include enabling Protected View and Protected Mode (sandbox) in Reader preferences to constrain code execution, disabling JavaScript in Acrobat (Preferences > JavaScript) which removes a common heap-grooming primitive at the cost of breaking interactive forms, and using email gateway or EDR rules to detonate or strip PDFs from untrusted senders. Organizations can also redirect PDF handling to a hardened viewer or browser-based renderer for external attachments, accepting reduced fidelity for Acrobat-specific features.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today