EUVD-2026-35820
GHSA-cgvm-cjwc-rjg3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) is possible when a victim opens a maliciously crafted PDF, triggering a use-after-free memory corruption flaw. Code runs with the privileges of the current user, and no public exploit identified at time of analysis, though Adobe has released APSB26-63 as the corresponding advisory.
Technical ContextAI
The vulnerability is a CWE-416 Use-After-Free in Adobe Acrobat Reader's PDF parsing/rendering engine. Use-after-free flaws occur when a program continues to reference heap memory after it has been freed, allowing an attacker who controls subsequent heap allocations to place attacker-controlled data into the freed slot. When the dangling pointer is dereferenced (typically a virtual function call or object method), control flow can be hijacked. The affected CPE (cpe:2.3:a:adobe:acrobat_reader:*) covers Acrobat Reader builds in both the classic (24.x) and continuous (26.x) tracks. PDF readers are historically a high-value target for memory corruption exploitation because complex parsers (JavaScript engine, XFA, font/image decoders) provide a large attack surface.
RemediationAI
Apply the updates referenced in Adobe security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html), which supersedes the vulnerable 24.001.30365 and 26.001.21651 builds - administrators should consult the bulletin for the exact patched build numbers per track and platform. Where immediate patching is not feasible, compensating controls include enabling Protected View for files originating from the internet (Edit > Preferences > Security (Enhanced)), disabling JavaScript in Acrobat Reader to reduce parser attack surface (acknowledging this breaks form workflows), blocking inbound PDFs at the mail gateway or detonating them in a sandbox, and using application allowlisting or attack surface reduction rules (e.g., Microsoft ASR rule blocking Office/Reader child process creation) to limit post-exploitation impact. Patch status: vendor advisory APSB26-63 indicates a patch is available; exact fixed version should be taken from the advisory.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today