EUVD-2026-35811
GHSA-mh5m-9j33-8rgv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs through a use-after-free condition triggered by opening a malicious PDF document. Successful exploitation runs code in the context of the current user, but no public exploit identified at time of analysis and the issue requires user interaction to open the crafted file.
Technical ContextAI
Acrobat Reader is Adobe's widely deployed PDF viewer used across enterprise endpoints and consumer systems. The flaw is classified as CWE-416 (Use After Free), a memory-corruption class where the application continues to reference heap memory after it has been freed, enabling an attacker who controls the reallocated chunk to overwrite a function pointer or virtual table and redirect execution. The CPE cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* indicates all build variants up to the listed versions are in scope. The advisory tag set (RCE, Use After Free, Memory Corruption) is consistent with the typical Acrobat parser/JavaScript-engine UAF pattern Adobe patches in its quarterly Patch Tuesday bulletins.
RemediationAI
Apply the patched Acrobat Reader builds listed in Adobe security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) - patch available per vendor advisory; install the fixed release on every endpoint via Adobe's auto-update, SCCM/Intune, or your endpoint management tool. Until patches are deployed, compensating controls include disabling JavaScript in Acrobat Reader (Preferences > JavaScript > uncheck 'Enable Acrobat JavaScript'), which removes a common UAF trigger surface but breaks interactive PDF forms; enabling Protected View for 'Files from potentially unsafe locations' or 'All files', which sandboxes rendering at the cost of some usability; blocking inbound PDFs at the mail gateway or detonating them in a sandbox for high-risk user groups; and using attachment-filtering or application-control policies to prevent untrusted PDFs from being opened by Reader directly.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today