CVE-2026-47913: Acrobat Reader RCE Vulnerability

CVE-2026-47913 Overview

CVE-2026-47913 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. Successful exploitation allows arbitrary code execution in the context of the current user. The flaw requires user interaction, as a victim must open a malicious file crafted by an attacker. Adobe published a security advisory addressing this issue. The vulnerability carries local attack characteristics with high impact to confidentiality, integrity, and availability.

Critical Impact

Attackers who convince a user to open a malicious PDF can execute arbitrary code with the privileges of the current user, enabling malware deployment, credential theft, or lateral movement.

Affected Products

• Adobe Acrobat Reader version 24.001.30365 and earlier
• Adobe Acrobat Reader version 26.001.21651 and earlier
• Adobe Acrobat (Classic and Continuous tracks within the affected ranges)

Discovery Timeline

• 2026-06-09 - CVE-2026-47913 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47913

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] within Adobe Acrobat Reader's document processing logic. The application references memory after it has been freed, allowing an attacker to control the contents of the dangling pointer. When the freed memory region is reallocated with attacker-controlled data, dereferencing the stale pointer redirects execution to attacker-supplied code paths. The result is arbitrary code execution under the privileges of the user running Acrobat Reader.

Exploitation is local and requires user interaction. A victim must open a malicious PDF delivered through phishing, drive-by download, or shared file repositories. Because Acrobat Reader is widely deployed across enterprise endpoints, malicious PDFs remain a common initial access vector.

Root Cause

The root cause is improper memory lifecycle management. Acrobat Reader retains a reference to a memory object after the object has been deallocated. Subsequent operations on that reference treat reclaimed memory as if it remained valid, breaking the assumption that freed objects are no longer reachable. An attacker shapes the heap with controlled allocations to place chosen data where the freed object resided.

Attack Vector

The attack vector is local and requires the victim to open a crafted document. An attacker constructs a PDF containing malformed objects, scripts, or embedded structures that trigger the vulnerable code path. When Acrobat Reader parses the document, the Use After Free condition fires, and the attacker gains code execution within the Reader process. From there, attackers can drop payloads, escalate privileges through chained exploits, or establish persistence.

No verified public proof-of-concept code is available. For technical details, refer to the Adobe Acrobat Security Advisory.

Detection Methods for CVE-2026-47913

Indicators of Compromise

• Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, such as cmd.exe, powershell.exe, or rundll32.exe
• Acrobat Reader processes performing network connections to unfamiliar external hosts shortly after opening a PDF
• Suspicious file writes to user-writable directories (%APPDATA%, %TEMP%) originating from the Reader process
• Crash dumps or Windows Error Reporting events referencing Acrobat Reader memory access violations

Detection Strategies

• Monitor for process lineage anomalies where Acrobat Reader spawns scripting interpreters or LOLBins
• Inspect PDF attachments at the email gateway for malformed object streams, embedded JavaScript, and known exploit signatures
• Correlate Acrobat Reader crashes with subsequent suspicious activity on the same host
• Apply YARA rules targeting known Use After Free exploitation patterns in PDF objects

Monitoring Recommendations

• Enable command-line and process creation logging (Windows Event ID 4688, Sysmon Event ID 1) across endpoints
• Forward Acrobat Reader telemetry to a centralized SIEM for behavioral correlation
• Track Acrobat Reader version inventory to identify unpatched hosts
• Alert on outbound traffic from document reader processes to non-corporate destinations

How to Mitigate CVE-2026-47913

Immediate Actions Required

• Update Adobe Acrobat Reader to the latest fixed release per the Adobe Acrobat Security Advisory
• Block inbound PDFs from untrusted sources at email and web gateways pending patch deployment
• Enable Protected View and Protected Mode in Acrobat Reader to limit process privileges
• Restrict execution of child processes from Acrobat Reader using application control or attack surface reduction rules

Patch Information

Adobe released fixed versions of Acrobat Reader through advisory APSB26-63. Administrators should deploy the updated builds across all endpoints running affected versions 24.001.30365, 26.001.21651, and earlier. Validate patch coverage through software inventory tooling and confirm the installed version exceeds the vulnerable ranges.

Workarounds

• Enable Acrobat Reader's Enhanced Security and Protected View settings to sandbox untrusted documents
• Disable JavaScript execution within Acrobat Reader through Edit > Preferences > JavaScript
• Deploy Windows Defender Attack Surface Reduction rules to block Office and document reader child process creation
• Restrict PDF handling to a hardened, sandboxed viewer on high-risk user segments until patches are applied

# Configuration example: Disable JavaScript in Acrobat Reader via registry (Windows)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f