EUVD-2026-35821
GHSA-g56m-wmx8-g7cr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Heap-based buffer overflow in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier enables arbitrary code execution in the context of the logged-in user when a victim opens a maliciously crafted document. No public exploit has been identified at time of analysis, but the high CVSS of 7.8 reflects severe local impact, and Acrobat Reader's massive install base makes it a perennial phishing target. Exploitation requires user interaction, which moderates urgency relative to zero-click flaws but does not eliminate risk in document-heavy enterprise environments.
Technical ContextAI
The flaw is classified as CWE-122 (Heap-based Buffer Overflow), a memory-safety defect in which untrusted data written past the bounds of a heap-allocated buffer corrupts adjacent memory structures such as object headers, function pointers, or vtables. In a complex parser like Acrobat Reader - which processes PDF streams, embedded fonts, JavaScript, JBIG2/JPEG2000 images, and XFA forms - a malformed object can cause an undersized allocation followed by an oversized copy, giving an attacker control over heap metadata or program counter through techniques such as heap grooming and use of corrupted virtual tables. The affected CPE 'cpe:2.3:a:adobe:acrobat_reader:*' indicates all Reader builds at or below the listed versions are in scope across the supported tracks (Continuous DC-style 24.x and the next-generation 26.x line).
RemediationAI
Upgrade Adobe Acrobat Reader to a version newer than 24.001.30365 (24.x track) or 26.001.21651 (26.x track) as published in Adobe Security Bulletin APSB26-63 at https://helpx.adobe.com/security/products/acrobat/apsb26-63.html; exact fix build numbers should be taken directly from that advisory. If immediate patching is not possible, set Reader to Protected View for all files originating from the Internet and unsafe locations (Edit → Preferences → Security (Enhanced) → enable Protected View for 'Files from potentially unsafe locations'), which contains the renderer in a sandbox but breaks some interactive form and JavaScript workflows. Block inbound PDFs at the email gateway or detonate them in a sandbox for high-risk inboxes, accepting that this will delay legitimate document delivery. Enterprises can also enforce opening PDFs in a browser-based renderer (Chrome/Edge PDF viewer) via GPO file association, which reduces Reader exposure at the cost of losing advanced Reader features like AcroForms and digital signatures.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today