CVE-2026-47912: Acrobat Reader RCE Vulnerability

CVE-2026-47912 Overview

CVE-2026-47912 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. The flaw allows attackers to execute arbitrary code in the context of the current user. Exploitation requires user interaction: a victim must open a malicious PDF file crafted by the attacker.

Adobe published the security advisory tracking this issue under bulletin APSB26-63. The vulnerability scores 7.8 on the CVSS v3.1 scale, with local attack vector and high impact across confidentiality, integrity, and availability.

Critical Impact

Successful exploitation grants arbitrary code execution at the privilege level of the user running Acrobat Reader, enabling malware installation, credential theft, or lateral movement from the compromised endpoint.

Affected Products

• Adobe Acrobat Reader 24.001.30365 and earlier
• Adobe Acrobat Reader 26.001.21651 and earlier
• Adobe Acrobat (Classic and Continuous tracks within the affected version ranges)

Discovery Timeline

• 2026-06-09 - CVE-2026-47912 published to the National Vulnerability Database
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47912

Vulnerability Analysis

The vulnerability is a Use After Free condition in Adobe Acrobat Reader's PDF parsing or rendering logic. Use After Free flaws occur when a program continues to reference memory after it has been freed. Attackers can reclaim the freed allocation with controlled data, then trigger code paths that dereference the stale pointer.

In the context of Acrobat Reader, a crafted PDF can manipulate object lifecycles within the document's structure. When the application accesses a freed object during rendering or scripting, the attacker-controlled memory contents can redirect execution flow. The result is arbitrary code execution within the user's security context.

The Adobe advisory APSB26-63 confirms the issue affects both the 24.x and 26.x release tracks. No public proof-of-concept exploit is currently known, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper management of object lifetimes during PDF processing. Acrobat Reader frees a memory object but retains a reference that is later dereferenced. Without intermediate validation, the dangling pointer becomes an exploitation primitive when the heap layout is groomed by attacker-supplied content.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious PDF through phishing email, drive-by download, instant messaging, or shared file storage. The victim must open the document with a vulnerable version of Acrobat Reader. Once opened, the embedded triggers within the PDF cause the Use After Free condition and hand control to attacker-supplied code.

The vulnerability cannot be triggered remotely without user action, but PDFs remain a high-volume phishing payload across enterprise environments.

No verified public exploitation code is available. See the Adobe Acrobat Security Advisory for vendor technical details.

Detection Methods for CVE-2026-47912

Indicators of Compromise

• Acrobat Reader processes (AcroRd32.exe, Acrobat.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
• Unexpected outbound network connections originating from Acrobat Reader processes shortly after a PDF is opened
• PDF files containing heavily obfuscated JavaScript, unusual object streams, or malformed cross-reference tables arriving via email or download

Detection Strategies

• Monitor parent-child process relationships where Acrobat Reader spawns shells, scripting hosts, or living-off-the-land binaries
• Inspect email gateways and web proxies for PDFs flagged with anomalous structure or embedded active content
• Apply YARA rules targeting known PDF exploitation patterns and Use After Free triggers in PDF object streams

Monitoring Recommendations

• Log Acrobat Reader process creation, module loads, and network telemetry from endpoints using EDR or Sysmon
• Correlate file write events in user profile paths following Acrobat Reader execution to identify post-exploitation payload drops
• Track Acrobat Reader version inventory across endpoints to confirm patch coverage and surface outliers

How to Mitigate CVE-2026-47912

Immediate Actions Required

• Update Adobe Acrobat and Acrobat Reader to the patched versions listed in Adobe security bulletin APSB26-63
• Block inbound PDF attachments from untrusted external senders at the email gateway pending patch deployment
• Restrict execution of Acrobat Reader on high-value endpoints through application control until updates are confirmed

Patch Information

Adobe has released fixed versions addressing CVE-2026-47912. Administrators should consult the Adobe Acrobat Security Advisory for the exact patched build numbers and apply updates through Adobe Update Manager, enterprise software distribution tools, or managed deployment channels.

Workarounds

• Enable Protected View and Protected Mode in Acrobat Reader to sandbox PDF rendering and limit exploit impact
• Disable JavaScript execution in Acrobat Reader through Preferences > JavaScript > Enable Acrobat JavaScript
• Configure attack surface reduction policies to prevent Acrobat Reader from spawning child processes or executing scripting interpreters

# Configuration example - disable Acrobat JavaScript via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f