EUVD-2026-35815
GHSA-6r9r-9qrm-vxmf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs through a use-after-free flaw triggered when a victim opens a maliciously crafted PDF document. Code executes in the context of the current user, making this a classic client-side document exploit vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must open a maliciously crafted PDF file in a vulnerable Acrobat Reader build (24.001.30365 / 26.001.21651 or earlier) - user interaction (UI:R) is mandatory per the CVSS vector, so silent network-side exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects local attack vector with required user interaction - meaning the malicious PDF must reach the victim and be opened, which is trivially achieved via phishing, drive-by download, or shared file storage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker emails or hosts a crafted PDF that, when opened in a vulnerable Acrobat Reader build, manipulates object lifetimes to dereference a freed heap object, hijacks control flow, and executes shellcode as the logged-in user - typically dropping a loader for follow-on access. Because exploitation runs at user privileges, the attacker proceeds with credential theft from the user's profile, browser session hijacking, or staging tools for lateral movement and privilege escalation. … |
| Remediation | Apply the patched Acrobat Reader builds released in Adobe Security Bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); upgrade any 24.x install above 24.001.30365 and any 26.x install above 26.001.21651 to the fixed release listed by Adobe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Issue security alert to all staff instructing them to avoid opening PDFs from untrusted sources; disable PDF preview features in email clients. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs via an uncontrol
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier results from a use-afte
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) occurs when a victim
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) is possible when a vi
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) is triggered when a
Share
External POC / Exploit Code
Leaving vuln.today