EUVD-2026-45290
GHSA-3m86-q6fx-m5cm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open exploitation is modeled AV:L with UI:R; no privileges needed (PR:N), low complexity, and code execution as the current user yields high C/I/A with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. All affected versions covered by Adobe advisory APSB26-63 are impacted, and successful exploitation grants full high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk is currently latent rather than active.
Technical ContextAI
Acrobat Reader is Adobe's near-ubiquitous PDF viewer, which parses complex, richly structured document content (fonts, images, embedded objects, JavaScript, and stream filters). The root cause is a CWE-122 heap-based buffer overflow, meaning a length or size field within the parsed file is mishandled such that attacker-controlled data is written past the bounds of a heap-allocated buffer. Corrupting adjacent heap metadata or object pointers can be leveraged to hijack control flow and achieve code execution in the process - and thus the current user's - security context. The CPE cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* indicates the application itself (all listed versions) is the affected component rather than a specific plugin or OS layer.
RemediationAI
Apply the Adobe security update referenced in bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); patch available per vendor advisory, though an exact fixed version string was not provided in the input and must be taken from that advisory for your platform and track (Continuous vs. Classic). Enable Acrobat Reader's automatic update mechanism to ensure timely deployment. As compensating controls until patching completes, keep Protected Mode / Protected View (sandbox) enabled to contain exploitation, and restrict or block opening of PDFs from untrusted sources via email and web gateways; note the trade-off that Protected View can break some interactive PDF workflows and JavaScript-dependent forms, and aggressive attachment filtering may delay legitimate documents. Disabling embedded JavaScript in Reader preferences further reduces attack surface at the cost of form and dynamic-document functionality.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today