EUVD-2026-35814
GHSA-r874-vvv4-pw47
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) is possible when a victim opens a maliciously crafted PDF that triggers a use-after-free condition in the parser. Exploitation runs at the privilege of the user opening the file, and no public exploit identified at time of analysis. CVSS 7.8 reflects the local attack vector and required user interaction, but Reader's massive install base makes this a high-value target for phishing-driven campaigns.
Technical ContextAI
Adobe Acrobat Reader (CPE cpe:2.3:a:adobe:acrobat_reader) is the de facto desktop PDF viewer and parses an extremely complex format that includes JavaScript, embedded fonts, forms, and rich media - all historically rich sources of memory-corruption bugs. CWE-416 (Use After Free) means an object is freed while a dangling pointer remains in use; an attacker who can control the contents of reallocated heap memory between the free and the subsequent dereference can hijack control flow, typically by overwriting a virtual function pointer or callback to redirect execution. The CVSS scope of Unchanged with C:H/I:H/A:H indicates full compromise of the user's process context, which on Windows/macOS workstations usually means access to the user's documents, browser sessions, and corporate SSO material.
RemediationAI
Apply the Adobe-released updates documented in security bulletin APSB26-63 at https://helpx.adobe.com/security/products/acrobat/apsb26-63.html, which supersedes 24.001.30365 on the Classic track and 26.001.21651 on the Continuous track - install the next published build for whichever track your fleet follows. Where immediate patching is not possible, enable Protected Mode and Protected View (the default sandbox in current Reader builds), block or quarantine PDF attachments at the email gateway from untrusted senders, and consider associating .pdf with a hardened alternative viewer for high-risk users; trade-offs include broken interactive forms, signing workflows, and rendering fidelity for engineering PDFs. Endpoint EDR rules that alert on AcroRd32.exe or Acrobat.exe spawning cmd.exe, powershell.exe, or other LOLBins provide useful post-exploitation detection during the patch window.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today