EUVD-2026-35815
GHSA-6r9r-9qrm-vxmf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs through a use-after-free flaw triggered when a victim opens a maliciously crafted PDF document. Code executes in the context of the current user, making this a classic client-side document exploit vector. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
The vulnerability is a CWE-416 Use-After-Free defect in Adobe Acrobat Reader (CPE cpe:2.3:a:adobe:acrobat_reader), the most widely deployed PDF rendering application on Windows and macOS endpoints. Use-after-free bugs occur when memory is freed but a dangling pointer continues to reference it; an attacker who can influence subsequent heap allocations can place controlled data where the freed object lived, then trigger a call that dereferences the stale pointer - typically leading to control of a virtual function table or function pointer and ultimately arbitrary code execution. PDF parsers are a recurring source of such bugs because they handle complex object graphs (JavaScript, embedded fonts, XFA forms, image streams) that exercise large amounts of allocation/deallocation logic.
RemediationAI
Apply the patched Acrobat Reader builds released in Adobe Security Bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); upgrade any 24.x install above 24.001.30365 and any 26.x install above 26.001.21651 to the fixed release listed by Adobe. If immediate patching is not feasible, compensating controls include enabling Acrobat's Protected View / Protected Mode sandbox for all files originating from untrusted locations (default in recent versions; verify via registry policy bProtectedMode=1 and iProtectedView=2), blocking inbound PDFs at the email gateway from external senders, and using GPO/MDM to associate the .pdf extension with a non-Adobe reader (e.g., browser-based PDF rendering in Chrome/Edge) for untrusted contexts - the trade-off being loss of advanced Reader features such as forms, digital signatures, and JavaScript-driven workflows. Disabling JavaScript in Acrobat (bDisableJavaScript=1) reduces the attack surface for many UAF triggers but breaks interactive forms used in enterprise document workflows.
More in Acrobat Reader
View allAdobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today