EUVD-2026-35819
GHSA-7v9g-2jg3-77x9
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier is possible when a victim opens a maliciously crafted file that triggers a use-after-free in the document parser. The flaw runs code in the context of the logged-in user and carries a CVSS 7.8 (High) score, but requires user interaction; no public exploit identified at time of analysis and EPSS data is not provided in the input.
Technical ContextAI
Acrobat Reader is Adobe's PDF rendering and document handling client deployed broadly on enterprise endpoints. The root cause class is CWE-416 (Use After Free), a memory corruption weakness in which freed heap memory is later dereferenced - an attacker who controls the contents of the reallocated region can corrupt object metadata, function pointers, or vtables and steer execution. CPE coverage (cpe:2.3:a:adobe:acrobat_reader:*) does not enumerate specific builds, so defenders should rely on the explicit version cutoffs (24.001.30365 and 26.001.21651) from the description. The bug is reachable through Acrobat's complex PDF object/stream parser, which is a historically frequent source of UAF and type-confusion bugs.
RemediationAI
Apply the Adobe-released patch by upgrading Acrobat Reader to a version newer than 24.001.30365 on the 24.x branch or newer than 26.001.21651 on the 26.x branch, per Adobe Security Bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); the bulletin lists the exact fixed builds for each track and platform. Where immediate patching is not possible, compensating controls include enabling Acrobat's Protected View for files originating from the Internet and untrusted locations (trade-off: some interactive PDF features are restricted), blocking inbound PDF attachments at the email gateway or sandbox-detonating them before delivery (trade-off: workflow friction for legitimate PDFs), and restricting the Reader process via AppLocker/WDAC or EDR rules so it cannot spawn shells or write to autorun locations (trade-off: may break legitimate plug-ins). Do not rely on file-extension blocking alone, as attackers commonly rename or embed PDFs.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today