EUVD-2026-35815
GHSA-6r9r-9qrm-vxmf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs through a use-after-free flaw triggered when a victim opens a maliciously crafted PDF document. Code executes in the context of the current user, making this a classic client-side document exploit vector. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
The vulnerability is a CWE-416 Use-After-Free defect in Adobe Acrobat Reader (CPE cpe:2.3:a:adobe:acrobat_reader), the most widely deployed PDF rendering application on Windows and macOS endpoints. Use-after-free bugs occur when memory is freed but a dangling pointer continues to reference it; an attacker who can influence subsequent heap allocations can place controlled data where the freed object lived, then trigger a call that dereferences the stale pointer - typically leading to control of a virtual function table or function pointer and ultimately arbitrary code execution. PDF parsers are a recurring source of such bugs because they handle complex object graphs (JavaScript, embedded fonts, XFA forms, image streams) that exercise large amounts of allocation/deallocation logic.
RemediationAI
Apply the patched Acrobat Reader builds released in Adobe Security Bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); upgrade any 24.x install above 24.001.30365 and any 26.x install above 26.001.21651 to the fixed release listed by Adobe. If immediate patching is not feasible, compensating controls include enabling Acrobat's Protected View / Protected Mode sandbox for all files originating from untrusted locations (default in recent versions; verify via registry policy bProtectedMode=1 and iProtectedView=2), blocking inbound PDFs at the email gateway from external senders, and using GPO/MDM to associate the .pdf extension with a non-Adobe reader (e.g., browser-based PDF rendering in Chrome/Edge) for untrusted contexts - the trade-off being loss of advanced Reader features such as forms, digital signatures, and JavaScript-driven workflows. Disabling JavaScript in Acrobat (bDisableJavaScript=1) reduces the attack surface for many UAF triggers but breaks interactive forms used in enterprise document workflows.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today