EUVD-2026-35817
GHSA-77hv-x6q3-c6j4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) is possible when a victim opens a maliciously crafted document, triggering a use-after-free condition in the renderer. The flaw runs code in the context of the current user and has no public exploit identified at time of analysis, though Adobe issued advisory APSB26-63 confirming the vulnerability class and affected versions.
Technical ContextAI
The vulnerability is a CWE-416 Use-After-Free in Adobe Acrobat Reader, a ubiquitous PDF rendering client. Use-after-free bugs occur when memory is freed but a dangling pointer is still dereferenced, allowing an attacker who controls heap layout (via crafted PDF objects, JavaScript, XFA forms, or font/image streams) to coerce the freed slot into holding attacker-controlled data, then hijack control flow when the stale pointer is reused. The CPE (cpe:2.3:a:adobe:acrobat_reader:*) indicates the desktop Acrobat Reader product line; the document-parsing surface in Reader has historically been a high-value target due to the complexity of PDF, JavaScript engine integration, and the variety of embedded object types it processes.
RemediationAI
Apply the patched build identified in Adobe Security Bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) - patch available per vendor advisory; consult the bulletin for the exact fixed version numbers for the 24.x and 26.x update tracks on your platform. If patching cannot be completed immediately, compensating controls include disabling JavaScript execution within Acrobat Reader via Edit > Preferences > JavaScript (reduces attack surface for many PDF exploits but breaks dynamic forms), enabling Protected View / Protected Mode sandboxing for documents from untrusted sources (already default in recent versions but worth verifying via GPO), and blocking inbound PDFs at the email gateway or quarantining unsigned PDFs from external senders. Endpoint EDR rules that alert on AcroRd32.exe / Acrobat.exe spawning child processes such as cmd.exe, powershell.exe, or wscript.exe will catch most post-exploitation behavior.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today