Adobe Acrobat Reader CVE-2026-47923

Exploitation requires the victim to actively open a specially crafted PDF file in an affected version of Adobe Acrobat Reader (24.001.30365 or 26.001.21651 and earlier) on their local machine - this is the UI:R condition confirmed by the CVSS vector. The AV:L vector means the attack is scoped to local file execution; direct network-based triggering without file delivery is not possible. PR:N confirms no attacker account or privilege on the target system is needed prior to file delivery. Exploitation is limited to confidentiality impact only (I:N/A:N), ruling out code execution or denial of service from this primitive alone. There is no indication in available data that a specific non-default Acrobat configuration is required - any default installation opening the malicious file is potentially vulnerable.

CVSS 5.5 Medium is calibrated appropriately for this vulnerability class. The AV:L (local) vector requires the malicious file to be present and opened on the victim's machine, preventing direct network exploitation and substantially limiting the attacker's reach compared to AV:N vulnerabilities. AC:L and PR:N indicate the exploit requires no special conditions or privileges beyond file delivery, but UI:R is a meaningful friction point - the victim must actively open the document. The C:H score reflects that leaked memory could contain sensitive data (encryption keys, credentials, document content) from adjacent allocations. No EPSS data was provided, preventing quantitative exploitation probability assessment. No KEV listing and no confirmed POC further reduce immediate operational risk. Overall, this is a real but non-critical finding: it warrants patching on schedule but does not justify emergency out-of-band response absent evidence of targeted exploitation.

An attacker crafts a malicious PDF containing structures designed to trigger an out-of-bounds read in Acrobat Reader's parsing engine, then delivers it to a target via phishing email or a compromised download link. When the victim opens the file in an affected Acrobat Reader version, the OOB read leaks adjacent memory contents - potentially including heap data such as pointers, keys, or document content - back to the attacker through a rendering side-channel or embedded callback. No public POC is confirmed, so this scenario is based on the vulnerability class and CVSS vector rather than observed exploitation.