EUVD-2026-35824
GHSA-349x-cfmq-2m5w
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) is triggered when a user opens a malicious PDF, exploiting a Use-After-Free memory corruption flaw to run code as the current user. No public exploit identified at time of analysis, and EPSS data was not provided, but the high CVSS of 7.8 combined with Reader's massive install base makes this a routine patch priority. Vendor (Adobe) issued advisory APSB26-63 with corrective updates.
Technical ContextAI
Acrobat Reader is Adobe's ubiquitous PDF rendering client; the affected CPE cpe:2.3:a:adobe:acrobat_reader:*:* indicates the desktop application across platforms. CWE-416 (Use After Free) is a memory-safety bug class where the application continues to reference heap memory after it has been freed, allowing an attacker who can control reallocation of that memory region to overwrite object metadata or function pointers and redirect execution. In a complex C/C++ document parser like Reader's PDF, font, JavaScript, and XFA engines, UAFs are commonly reachable through specially crafted object streams, malformed cross-reference tables, or scripted document events that cause premature object deallocation.
RemediationAI
Apply the Adobe security update referenced in advisory APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) to upgrade Acrobat Reader past the affected 24.001.30365 / 26.001.21651 builds - Patch available per vendor advisory; consult the bulletin for the exact fixed version per track. As compensating controls until patching, enable Protected View for files originating from the internet and untrusted locations (Edit > Preferences > Security (Enhanced)), enforce Protected Mode (the sandbox) so any successful code execution is contained, and disable JavaScript in Acrobat (Preferences > JavaScript) to shrink the attack surface - trade-off being broken interactive forms and some enterprise workflows. Email and web gateways should sandbox-detonate PDF attachments, and AppLocker/WDAC policies can restrict AcroRd32.exe from spawning script hosts or shells to blunt post-exploitation.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today