EUVD-2026-35812
GHSA-xhqq-g9f7-p2wv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier stems from a Use After Free condition (CWE-416) that triggers when a victim opens a malicious PDF, yielding execution in the context of the current user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the file-opening attack pattern is a perennial favorite in phishing and document-borne campaigns targeting Acrobat. Adobe has shipped fixed builds under advisory APSB26-63.
Technical ContextAI
Adobe Acrobat Reader is the dominant PDF rendering client on Windows and macOS and processes a sprawling attack surface including JavaScript, XFA forms, embedded fonts, images, and 3D objects. CWE-416 (Use After Free) means a pointer to a heap object is reused after the underlying object has been freed, typically because object lifetime is managed across multiple subsystems (e.g., scripted callbacks vs. document teardown). When an attacker can shape the heap and steer the dangling pointer to attacker-controlled data, the freed-then-reused object can be coerced into hijacking control flow, leading to native code execution. The affected CPE is cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* covering all platform variants prior to the fix.
RemediationAI
Apply the vendor-released patch by updating Acrobat Reader to the fixed builds published in Adobe security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); the advisory enumerates the specific post-24.001.30365 and post-26.001.21651 versions per track. Where immediate patching is not possible, compensating controls include enabling Protected View / Protected Mode for files originating from the Internet (default on Windows but verify policy), disabling JavaScript in Acrobat preferences to shrink the typical UAF trigger surface (side effect: breaks interactive forms), and blocking inbound PDFs from untrusted senders at the mail gateway or detonating them in a sandbox before delivery. User-awareness reinforcement against opening unsolicited PDFs is a worthwhile adjunct given UI:R is required.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today