Adobe Acrobat Reader CVE-2026-47961

User interaction is required: a victim must actively open a malicious PDF file using an affected version of Adobe Acrobat Reader (versions 24.001.30365 or 26.001.21651 or earlier). The CVSS attack vector is local (AV:L), meaning the exploit triggers within the victim's own process when the file is opened - not via a network-reachable service. No attacker privileges are required (PR:N), but the attacker must successfully deliver the malicious file to the victim and induce them to open it. Exploitation is limited by: the required user interaction (UI:R) which prevents silent drive-by exploitation, the local attack vector which prevents direct remote triggering, and the read-only impact which constrains damage to confidentiality. There is no indication of non-default configuration requirements - any user opening a malicious PDF in an unpatched Acrobat Reader instance is potentially affected.

The CVSS 5.5 Medium score reflects a constrained but realistic risk profile. The vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reveals that exploitation is local (the victim must open the file on their own system), requires no attacker privileges, demands user interaction, and is scoped to the victim process with no lateral impact. The high confidentiality impact score elevates practical concern: leaked memory can contain encryption keys, authentication tokens, or other sensitive in-memory data, making this a viable component of a multi-stage attack chain. No EPSS data was provided in the intelligence feed, so exploitation probability cannot be quantitatively assessed. The absence of a KEV listing and lack of any reported POC suggest this has not been weaponized broadly. The tag discrepancy - 'Buffer Overflow' listed alongside CWE-125 - should not be misread as implying write primitives; this is a read-only vulnerability at current analysis confidence. Risk is most relevant in environments where users regularly open untrusted PDFs (legal, finance, HR workflows).

An attacker crafts a malicious PDF file engineered to trigger an out-of-bounds read during Acrobat Reader's document parsing - for example, by embedding a malformed stream object with an incorrect length field. The attacker delivers the file via phishing email or a drive-by download, and when the victim opens it in an affected version of Acrobat Reader, the parser reads beyond the allocated buffer and exposes adjacent memory contents - potentially including session tokens, cached credentials, or decrypted document key material - which the attacker could subsequently extract if combined with a secondary exfiltration technique. No public POC is known at time of analysis.