EUVD-2026-35808
GHSA-q448-g337-rv32
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) occurs via a stack-based buffer overflow triggered when a victim opens a malicious PDF. Successful exploitation runs attacker code in the context of the current user, making this a viable initial-access vector through phishing or drive-by document delivery. No public exploit identified at time of analysis, but the bug class (CWE-121) and Acrobat's broad install base historically attract weaponization quickly after disclosure.
Technical ContextAI
The affected component is Adobe Acrobat Reader, the dominant consumer PDF rendering engine on Windows and macOS, identified by CPE cpe:2.3:a:adobe:acrobat_reader. CWE-121 (Stack-based Buffer Overflow) means the flaw lies in a parser or handler that writes attacker-controlled data past the bounds of a fixed-size stack buffer, typically corrupting the saved return address, frame pointer, or adjacent local variables. In Acrobat, such bugs commonly reside in PDF object parsers, font/image decoders, JavaScript engine glue, or embedded media handlers, and bypass of stack canaries / ASLR / DEP is usually required to convert memory corruption into reliable code execution.
RemediationAI
Apply Adobe's vendor-released patch as documented in APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) by upgrading Acrobat Reader to the post-24.001.30365 / post-26.001.21651 builds Adobe lists for each track; exact fix versions should be taken directly from that advisory. Until patching is complete, compensating controls include enabling Acrobat's Protected View / Protected Mode (sandboxing) for files from untrusted locations, blocking inbound PDFs from external senders at the email gateway or detonating them in a sandbox, and using Group Policy or the Windows registry to disable JavaScript in Acrobat (FeatureLockDown\bDisableJavaScript=1) - note that disabling JavaScript will break interactive forms and some enterprise PDF workflows, and Protected View may interfere with legitimate plugin behavior.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today