EUVD-2026-35826
GHSA-4446-c973-3qv5
Severity by source
AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Local file delivery and required user interaction; PR:L since exploitation hinges on a writable user-controlled directory rather than admin rights, with full impact and scope change to user resources.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionNVD
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Acrobat Reader 24.001.30365, 26.001.21651 and earlier arises from an uncontrolled search path element (CWE-427), enabling a local attacker to run code in the current user's context when a victim opens a malicious file. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC marks exploitation as 'none' with total technical impact. Adobe has released a fix via security bulletin APSB26-63.
Technical ContextAI
The flaw is a CWE-427 Uncontrolled Search Path Element, commonly known as DLL/library search-order hijacking on Windows or dylib hijacking on macOS. Acrobat Reader (cpe:2.3:a:adobe:acrobat_reader) loads helper libraries or plugins using a search path that an attacker can influence by placing a malicious binary in a directory consulted before the trusted location - typically the same folder as a PDF or a writable directory along the resolver's path. When a user opens a crafted PDF, the malicious library is loaded into Acrobat's process, granting code execution within the user session. The CVSS 'scope changed' flag (S:C) indicates the loaded code escapes Acrobat's security context to affect other resources accessible to the user.
RemediationAI
Apply Adobe's patched build released in security bulletin APSB26-63 (https://helpx.adobe.com/security/products/acrobat/apsb26-63.html); upgrade beyond Acrobat Reader 24.001.30365 and 26.001.21651 to the fixed version specified in that advisory - Patch available per vendor advisory, exact fixed build to be taken from APSB26-63. Until patching is complete, train users not to open PDFs from untrusted locations (especially network shares or downloaded archives where adversary-controlled binaries can coexist), restrict write access on directories that Acrobat references when loading helper modules, and remove world-writable entries from the per-user PATH to reduce hijack opportunities - note these controls add operational friction (slower PDF workflows, changes to deployment scripts) and do not fully replace the vendor patch. Endpoint application allowlisting (e.g., AppLocker/WDAC) blocking unsigned DLLs in user-writable paths is the most durable compensating control but requires baselining to avoid breaking legitimate add-ins.
More in Acrobat Reader
View allBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and M
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attack
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X a
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitra
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X a
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today