EUVD-2026-35813
GHSA-j22q-gxcf-m9cq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds read in Adobe Acrobat Reader exposes sensitive process memory when a victim opens a specially crafted PDF file. Affected versions include 24.001.30365, 26.001.21651, and all earlier releases across both tracks. The vulnerability carries a high confidentiality impact (C:H) with no integrity or availability consequence, making it a targeted information disclosure primitive rather than a code execution path. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety flaw in which the application reads data past the end of an allocated buffer during PDF parsing. Despite the 'Buffer Overflow' tag in the intelligence feed, the CWE and CVSS profile confirm this is a read-side violation, not a write - meaning exploitation produces memory disclosure rather than code execution. The affected product, confirmed via CPE cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*, is Adobe Acrobat Reader, Adobe's widely deployed PDF rendering engine. The local attack vector (AV:L) indicates the vulnerability is triggered within the process context when the renderer parses a malicious PDF document on the victim's machine, consistent with a document-processing pipeline flaw in a format parser or image decoder embedded within Acrobat Reader.
RemediationAI
Upgrade Adobe Acrobat Reader to a version beyond 24.001.30365 (on the 24.x track) or beyond 26.001.21651 (on the 26.x track) per Adobe Security Bulletin APSB26-63 at https://helpx.adobe.com/security/products/acrobat/apsb26-63.html. Patch status is confirmed via vendor advisory; exact successor fix versions should be verified directly in APSB26-63, as successor release numbers are not independently confirmed in the provided intelligence data. As a compensating control where patching is not immediately feasible, configure Acrobat Reader's Protected View to activate for 'All files' under Edit > Preferences > Security (Enhanced), which sandboxes document rendering and limits the memory disclosure surface. Additionally, deploying email gateway or endpoint DLP controls to inspect and quarantine PDF attachments from untrusted sources reduces the social engineering delivery vector without requiring application changes. Note that Protected View imposes a workflow friction cost, as users must explicitly trust documents before full rendering.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today