EUVD-2026-35812
GHSA-xhqq-g9f7-p2wv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier stems from a Use After Free condition (CWE-416) that triggers when a victim opens a malicious PDF, yielding execution in the context of the current user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the file-opening attack pattern is a perennial favorite in phishing and document-borne campaigns targeting Acrobat. Adobe has shipped fixed builds under advisory APSB26-63.
Technical ContextAI
Adobe Acrobat Reader is the dominant PDF rendering client on Windows and macOS and processes a sprawling attack surface including JavaScript, XFA forms, embedded fonts, images, and 3D objects. CWE-416 (Use After Free) means a pointer to a heap object is reused after the underlying object has been freed, typically because object lifetime is managed across multiple subsystems (e.g., scripted callbacks vs. document teardown). When an attacker can shape the heap and steer the dangling pointer to attacker-controlled data, the freed-then-reused object can be coerced into hijacking control flow, leading to native code execution. The affected CPE is cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* covering all platform variants prior to the fix.
RemediationAI
Apply the vendor-released patch by updating Acrobat Reader to the fixed builds published in Adobe security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); the advisory enumerates the specific post-24.001.30365 and post-26.001.21651 versions per track. Where immediate patching is not possible, compensating controls include enabling Protected View / Protected Mode for files originating from the Internet (default on Windows but verify policy), disabling JavaScript in Acrobat preferences to shrink the typical UAF trigger surface (side effect: breaks interactive forms), and blocking inbound PDFs from untrusted senders at the mail gateway or detonating them in a sandbox before delivery. User-awareness reinforcement against opening unsolicited PDFs is a worthwhile adjunct given UI:R is required.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today