Acrobat Reader CVE-2026-47925

Exploitation requires that the victim open a specially crafted malicious file using a vulnerable version of Adobe Acrobat Reader (24.001.30365 or earlier in the 24.x track, or 26.001.21651 or earlier in the 26.x track). The CVSS vector AV:L confirms a local attack vector - the malicious file must be present on the victim's local filesystem prior to exploitation. PR:N indicates no attacker privileges are required on the system, but UI:R mandates that the victim actively opens the file, which limits the attack to social engineering or phishing-based delivery. The impact is strictly a denial-of-service application crash (A:H, S:U) with no code execution, data exfiltration, or privilege escalation possible. No special system configuration or non-default product feature is required beyond the victim possessing a vulnerable Acrobat Reader installation.

The overall risk is moderate and primarily a nuisance-tier availability issue. CVSS 5.5 (Medium) is consistent with the limited impact profile: no confidentiality or integrity loss, scope unchanged, and the attack vector is Local (AV:L), meaning the malicious file must reach the victim's filesystem before exploitation can occur. User interaction (UI:R) is required - the victim must manually open the crafted file - which meaningfully constrains automated, mass-exploitation scenarios. No EPSS score was provided in the available intelligence; however, given the DoS-only impact and UI:R requirement, real-world exploitation probability is expected to be low. The vulnerability is not listed in the CISA KEV catalog, and no publicly available exploit code has been identified. This is a legitimate patching priority for organizations processing untrusted PDF documents, but it does not represent an urgent emergency response scenario. No conflicting signals were detected in the available data.

An attacker crafts a malicious PDF file containing integer values designed to trigger an overflow in Acrobat Reader's document parser, then delivers the file to a target user via email attachment, a download link, or a shared document platform. When the victim opens the file in an affected version of Acrobat Reader, the integer overflow causes the application to crash, resulting in a denial-of-service condition. No public proof-of-concept code has been identified, and given the local attack vector and UI:R requirement, exploitation would be targeted rather than opportunistic.