EUVD-2026-35817
GHSA-77hv-x6q3-c6j4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) is possible when a victim opens a maliciously crafted document, triggering a use-after-free condition in the renderer. The flaw runs code in the context of the current user and has no public exploit identified at time of analysis, though Adobe issued advisory APSB26-63 confirming the vulnerability class and affected versions.
Technical ContextAI
The vulnerability is a CWE-416 Use-After-Free in Adobe Acrobat Reader, a ubiquitous PDF rendering client. Use-after-free bugs occur when memory is freed but a dangling pointer is still dereferenced, allowing an attacker who controls heap layout (via crafted PDF objects, JavaScript, XFA forms, or font/image streams) to coerce the freed slot into holding attacker-controlled data, then hijack control flow when the stale pointer is reused. The CPE (cpe:2.3:a:adobe:acrobat_reader:*) indicates the desktop Acrobat Reader product line; the document-parsing surface in Reader has historically been a high-value target due to the complexity of PDF, JavaScript engine integration, and the variety of embedded object types it processes.
RemediationAI
Apply the patched build identified in Adobe Security Bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) - patch available per vendor advisory; consult the bulletin for the exact fixed version numbers for the 24.x and 26.x update tracks on your platform. If patching cannot be completed immediately, compensating controls include disabling JavaScript execution within Acrobat Reader via Edit > Preferences > JavaScript (reduces attack surface for many PDF exploits but breaks dynamic forms), enabling Protected View / Protected Mode sandboxing for documents from untrusted sources (already default in recent versions but worth verifying via GPO), and blocking inbound PDFs at the email gateway or quarantining unsigned PDFs from external senders. Endpoint EDR rules that alert on AcroRd32.exe / Acrobat.exe spawning child processes such as cmd.exe, powershell.exe, or wscript.exe will catch most post-exploitation behavior.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today