EUVD-2026-35816
GHSA-p279-mm9j-77g2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds read in Adobe Acrobat Reader versions 24.001.30365 and 26.001.21651 and earlier enables sensitive memory disclosure when a victim opens a specially crafted file. The vulnerability (CWE-125) exposes potentially high-value in-memory data - including heap addresses or document contents - but cannot be leveraged for code execution or system modification based on available data. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the vendor-confirmed advisory (APSB26-63) establishes this as a real, patched issue.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) occurs when a program reads memory beyond the boundary of an allocated buffer during file parsing. In Acrobat Reader's PDF processing pipeline, a malformed file structure can cause the parser to read past the end of a data buffer, exposing adjacent memory contents. The CPE string cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* covers all platform variants of Acrobat Reader across both the 24.x and 26.x release tracks. The CVSS vector AV:L confirms the attack surface is local - the vulnerable code path is reached only when a file is opened and parsed by the application, not via network-exposed services. While tagged 'Buffer Overflow' in source metadata, the CWE-125 classification and the CVSS impact profile (C:H, I:N, A:N) are consistent with a read-only overread, not a write-primitive exploitation path.
RemediationAI
Patch available per vendor advisory APSB26-63 at https://helpx.adobe.com/security/products/acrobat/apsb26-63.html - upgrade Acrobat Reader beyond versions 24.001.30365 (24.x track) and 26.001.21651 (26.x track). The exact fixed version numbers are not independently confirmed from the input data beyond the advisory reference; consult APSB26-63 directly for confirmed fix versions before deploying. Adobe's built-in auto-update mechanism can be used for consumer deployments; enterprise environments should use the Adobe Update Server or SCUP catalog. As a compensating control pending patching, consider enabling Protected Mode and Protected View in Acrobat Reader settings, which sandbox file rendering and reduce the attack surface for file-parsing vulnerabilities - though this does not eliminate the underlying flaw. Restricting users from opening PDF attachments directly in Acrobat Reader (enforcing preview-only in email clients) reduces exposure in high-risk environments.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today