EUVD-2026-36510
GHSA-hqrh-5g3x-gfcm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open delivery gives AV:L and UI:R; no privileges needed to craft the file (PR:N); arbitrary code execution as the user yields C:H/I:H/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) occurs through an out-of-bounds write triggered when a victim opens a malicious PDF file. Successful exploitation runs attacker code in the context of the current user, making this a classic client-side attack suitable for phishing campaigns. No public exploit identified at time of analysis, but Adobe Reader memory corruption flaws have a long history of being weaponized in targeted attacks.
Technical ContextAI
The vulnerability is an out-of-bounds write (CWE-787), a memory safety defect where the application writes data beyond the bounds of an allocated buffer, corrupting adjacent memory structures. In PDF parsers like Acrobat Reader, such flaws typically arise in the handling of complex embedded objects (fonts, images, JavaScript, XFA forms, or stream filters) where length fields, indices, or offsets from the file are trusted without proper validation. The CPE confirms the affected product is the desktop Adobe Acrobat Reader application across all platforms, and the tags identify this specifically as a memory corruption/buffer overflow class issue leading to RCE.
RemediationAI
Apply the Adobe-released update referenced in security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) to versions newer than 24.001.30365 and 26.001.21651; consult the bulletin for the exact fixed build for each track since the description lists vulnerable versions rather than fixed ones. Until patching is complete, enable Adobe Reader's Protected Mode/Protected View (which sandboxes PDF rendering and significantly raises the bar for exploitation at the cost of some functionality such as certain form features), block or strip PDFs from untrusted senders at the mail gateway, and consider associating PDF MIME types with a non-Adobe sandboxed viewer for high-risk users (trade-off: loss of fidelity for forms, signatures, and JavaScript-dependent documents).
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today