EUVD-2026-35825
GHSA-x63r-p5hm-g3jm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) occurs when a victim opens a maliciously crafted PDF, triggering a use-after-free memory corruption that lets the attacker run code with the privileges of the logged-on user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; however, Acrobat Reader is a perennial target for phishing-delivered malware, making patching a near-term priority. Adobe has issued APSB26-63 with fixed builds.
Technical ContextAI
Adobe Acrobat Reader is a widely deployed PDF viewer that parses complex, scriptable document objects (JavaScript, XFA forms, embedded media, AcroForms). CWE-416 (Use After Free) means application logic references a memory object after it has been freed, allowing an attacker who can influence the freed allocation's contents to corrupt control structures (vtables, function pointers) and pivot to code execution. The CPE string cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* covers Acrobat Reader across platforms, and the affected branches (24.x Classic-track and 26.x Continuous) indicate the flaw spans multiple maintained release trains. UAF flaws in PDF parsers typically arise from improper reference counting on document object models, callbacks, or JavaScript-managed objects.
RemediationAI
Patch available per vendor advisory: upgrade Adobe Acrobat Reader to the fixed versions enumerated in Adobe Security Bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html) - specifically the builds superseding 24.001.30365 (Classic) and 26.001.21651 (Continuous); exact post-patch version numbers should be taken from APSB26-63 rather than guessed. As compensating controls until patching completes, enable Acrobat Reader's Protected View for files originating from the internet and outlook attachments (Edit > Preferences > Security (Enhanced)), which contains exploitation within an AppContainer sandbox at the cost of some functionality such as form fill-in until the user explicitly trusts the document. Disabling JavaScript in Acrobat (Edit > Preferences > JavaScript, uncheck 'Enable Acrobat JavaScript') reduces the attack surface for many UAF flaws but breaks dynamic forms and interactive PDFs. Mail-gateway and proxy filtering of inbound PDFs from untrusted senders, combined with end-user awareness about not opening unexpected attachments, are appropriate stopgaps but do not address local files delivered via USB or shared storage.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today