EUVD-2026-35811
GHSA-mh5m-9j33-8rgv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs through a use-after-free condition triggered by opening a malicious PDF document. Successful exploitation runs code in the context of the current user, but no public exploit identified at time of analysis and the issue requires user interaction to open the crafted file.
Technical ContextAI
Acrobat Reader is Adobe's widely deployed PDF viewer used across enterprise endpoints and consumer systems. The flaw is classified as CWE-416 (Use After Free), a memory-corruption class where the application continues to reference heap memory after it has been freed, enabling an attacker who controls the reallocated chunk to overwrite a function pointer or virtual table and redirect execution. The CPE cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* indicates all build variants up to the listed versions are in scope. The advisory tag set (RCE, Use After Free, Memory Corruption) is consistent with the typical Acrobat parser/JavaScript-engine UAF pattern Adobe patches in its quarterly Patch Tuesday bulletins.
RemediationAI
Apply the patched Acrobat Reader builds listed in Adobe security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) - patch available per vendor advisory; install the fixed release on every endpoint via Adobe's auto-update, SCCM/Intune, or your endpoint management tool. Until patches are deployed, compensating controls include disabling JavaScript in Acrobat Reader (Preferences > JavaScript > uncheck 'Enable Acrobat JavaScript'), which removes a common UAF trigger surface but breaks interactive PDF forms; enabling Protected View for 'Files from potentially unsafe locations' or 'All files', which sandboxes rendering at the cost of some usability; blocking inbound PDFs at the mail gateway or detonating them in a sandbox for high-risk user groups; and using attachment-filtering or application-control policies to prevent untrusted PDFs from being opened by Reader directly.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today