Acrobat for Edge EUVD-2026-105254

Requires the victim to actively open or view attacker-controlled PDF/web content in Microsoft Edge's Acrobat/PDF rendering component - the description explicitly states the victim must visit a maliciously crafted URL or interact with a compromised web page, so mandatory user interaction (UI:R) is the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and default Edge configurations that render PDFs are affected, but exploitation is bounded to confidentiality-only impact (memory disclosure) and depends on the victim's engagement with the malicious content rather than any non-default server/feature setting.

Moderate, non-urgent risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity, unauthenticated out-of-bounds read whose only impact is limited confidentiality (C:L) via disclosure of process memory - no integrity or availability impact, and user interaction (UI:R) is mandatory. No EPSS score, KEV listing, or POC indicator was supplied, so exploitation likelihood cannot be quantified from the data: there is no public exploit identified at time of analysis and no evidence of active exploitation. The limited CWE-125 information-disclosure impact means this is realistically a lower-tier issue (potential ASLR/pointer leak or disclosure of adjacent sensitive memory) rather than a drive-by RCE, despite the memory-safety nature. Note a sourcing nuance: the product is attributed to Adobe (CPE cpe:2.3:a:adobe:acrobat_for_edge) yet the sole reference is a Microsoft MSRC advisory, consistent with Adobe's PDF engine embedded in Microsoft Edge - confirm the authoritative advisory and fixed build with both vendors. Priority: patch in normal cadence; it is not a stated priority emergency on current signals.

An attacker hosts a maliciously crafted PDF or web page and lures a victim into opening the malicious URL in Microsoft Edge's built-in Acrobat/PDF viewer. When Edge renders the crafted content, the out-of-bounds read is triggered and leaks adjacent process memory (e.g., pointers or sensitive data) back to attacker-influenced output. No public exploit is identified at time of analysis, and exploitation requires the victim's interaction (UI:R).