EUVD-2026-45290
GHSA-3m86-q6fx-m5cm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF file
-
DeliveryDeliver via email or web link
-
ExploitVictim opens file in Acrobat Reader
-
ExecutionTrigger heap-based buffer overflow
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a malicious file in Adobe Acrobat Reader (UI:R) - the attacker cannot trigger it remotely without this action, which is the primary limiting factor. No authentication or elevated privileges are needed on the attacker side (PR:N), and attack complexity is low (AC:L), so a single crafted PDF is sufficient once opened. The local attack vector (AV:L) means the file must be delivered to and rendered on the target host (via email, download, or removable media); it works against default configurations of Acrobat Reader but code execution is confined to the current user's privilege level (S:U), and sandbox/Protected View features, where enabled, further constrain the outcome. |
| Impact | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: local attack vector, low complexity, no privileges, but requiring user interaction, with high impact across all three properties. The AV:L designation reflects Adobe's standard modeling of file-open exploitation (the malicious file must reach and be opened on the target machine) rather than direct network reachability, so it is not remotely triggerable without luring a user. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified from this data; the absence of KEV means no confirmed active exploitation, and the absence of POC means no public exploit is identified at time of analysis. Net assessment: a credible, high-severity client-side RCE typical of Adobe's monthly patch cycle, but the mandatory user-interaction requirement and lack of any exploitation signal make it a standard-priority patch rather than an emergency, absent evidence of in-the-wild abuse. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF that triggers the heap overflow and emails it to a target or hosts it on a website, using a plausible pretext to induce the victim to open it in Acrobat Reader. When the file is opened, the malformed structure corrupts heap memory and the attacker's payload executes with the victim user's privileges. No public exploit is identified at time of analysis, so this remains a theoretical-but-realistic chain rather than a demonstrated one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
Arbitrary code execution in Adobe Acrobat Reader arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. All affected versions covered by Adobe advisory APSB26-63 are impacted, and successful exploitation grants full high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk is currently latent rather than active.
RemediationAI
Apply the Adobe security update referenced in bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); patch available per vendor advisory, though an exact fixed version string was not provided in the input and must be taken from that advisory for your platform and track (Continuous vs. Classic). Enable Acrobat Reader's automatic update mechanism to ensure timely deployment. As compensating controls until patching completes, keep Protected Mode / Protected View (sandbox) enabled to contain exploitation, and restrict or block opening of PDFs from untrusted sources via email and web gateways; note the trade-off that Protected View can break some interactive PDF workflows and JavaScript-dependent forms, and aggressive attachment filtering may delay legitimate documents. Disabling embedded JavaScript in Reader preferences further reduces attack surface at the cost of form and dynamic-document functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Acrobat Reader is Adobe's near-ubiquitous PDF viewer, which parses complex, richly structured document content (fonts, images, embedded objects, JavaScript, and stream filters). The root cause is a CWE-122 heap-based buffer overflow, meaning a length or size field within the parsed file is mishandled such that attacker-controlled data is written past the bounds of a heap-allocated buffer. Corrupting adjacent heap metadata or object pointers can be leveraged to hijack control flow and achieve code execution in the process - and thus the current user's - security context. The CPE cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* indicates the application itself (all listed versions) is the affected component rather than a specific plugin or OS layer.
Know when Acrobat Reader gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open exploitation is modeled AV:L with UI:R; no privileges needed (PR:N), low complexity, and code execution as the current user yields high C/I/A with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Acrobat Reader contains an arbitrary code execution vulnerability (CVE-2026-48373) triggered when users open maliciously crafted documents, with no public exploit identified at time of analysis. This creates direct risk of data breach and system compromise across the organization, affecting all employees and the integrity of business-critical information.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting PDF file access controls, disabling Acrobat Reader plugins, deploying browser-based PDF viewers as alternative handlers, enforcing file origin verification workflows, and implementing endpoint monitoring to detect unusual Acrobat process behavior indicative of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Exploit-DB