CVE-2026-47916: Acrobat Reader RCE Vulnerability

CVE-2026-47916 Overview

CVE-2026-47916 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. Successful exploitation allows attackers to execute arbitrary code in the context of the current user. The flaw requires user interaction: a victim must open a crafted malicious file for the exploit to trigger. Adobe published the security advisory APSB26-63 to address the issue. The vulnerability carries a CVSS 3.1 base score of 7.8 with a local attack vector, and impacts confidentiality, integrity, and availability.

Critical Impact
Attackers who deliver a malicious PDF can achieve arbitrary code execution with the privileges of the user opening the file.

Affected Products

Adobe Acrobat Reader version 24.001.30365 and earlier
Adobe Acrobat Reader version 26.001.21651 and earlier
Adobe Acrobat (corresponding builds covered by advisory APSB26-63)

Discovery Timeline

2026-06-09 - CVE-2026-47916 published to the National Vulnerability Database (NVD)
2026-06-10 - CVE record last modified in NVD

Technical Details for CVE-2026-47916

Vulnerability Analysis

The vulnerability is a Use After Free condition in Adobe Acrobat Reader. The application continues to reference memory that has already been released, allowing an attacker to influence the contents of that freed memory region. When the dangling pointer is later dereferenced, an attacker-controlled object can hijack program flow.

Exploitation results in arbitrary code execution within the security context of the user running Acrobat Reader. On endpoints where users hold administrative rights, the impact extends across the host. The attack vector is local and requires user interaction, so the typical delivery method is a malicious PDF distributed through phishing, drive-by download, or shared file repositories.

The CWE-416 class of bugs is a recurring source of code execution flaws in document parsers because complex object lifetimes within PDF rendering pipelines are difficult to track. EPSS currently rates the exploitation probability at 0.033%, indicating no widespread exploitation has been observed at this time.

Root Cause

The root cause is improper memory lifecycle management within Acrobat Reader's PDF processing code. An object is freed while a reference to it remains accessible. Subsequent operations on the stale reference allow an attacker to read or write into reclaimed memory, corrupting heap state and control structures.

Attack Vector

An attacker crafts a malicious PDF that triggers the Use After Free condition during parsing or rendering. The victim must open the file in a vulnerable version of Acrobat Reader. Once opened, the crafted content steers memory reuse to attacker-supplied data, yielding arbitrary code execution. Refer to the Adobe Acrobat Security Advisory APSB26-63 for technical details.

Detection Methods for CVE-2026-47916

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Acrobat Reader processes performing outbound network connections to untrusted hosts shortly after opening a PDF
Crash events or Windows Error Reporting entries referencing access violations in Acrobat Reader modules
PDF files arriving via email or web download containing embedded JavaScript or obfuscated object streams

Detection Strategies

Hunt for process lineage where Acrobat Reader is the parent of script interpreters or living-off-the-land binaries
Alert on file writes to user-writable persistence locations originating from Acrobat Reader processes
Inspect PDF content for malformed object structures and suspicious JavaScript actions using static analyzers
Correlate Acrobat crashes with subsequent suspicious process activity on the same endpoint

Monitoring Recommendations

Forward Acrobat Reader process telemetry, including command line and module load events, to a centralized analytics platform
Track installed Acrobat Reader versions across the fleet to identify endpoints still on vulnerable builds
Monitor email gateways for PDF attachments with unusual structure or sourced from low-reputation senders

How to Mitigate CVE-2026-47916

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB26-63 to all Acrobat and Acrobat Reader installations
Inventory endpoints running Acrobat Reader 24.001.30365, 26.001.21651, or earlier and prioritize them for patching
Restrict execution of PDFs from untrusted sources and enforce attachment scanning at email gateways

Patch Information

Adobe addressed CVE-2026-47916 in the updates documented in the Adobe Acrobat Security Advisory APSB26-63. Administrators should deploy the fixed builds through Adobe's update channel, enterprise software distribution tools, or managed update services. Verify version numbers post-deployment to confirm remediation.

Workarounds

Enable Acrobat Reader's Protected View and Protected Mode to sandbox PDF rendering
Disable JavaScript execution within Acrobat Reader through the application's preferences or group policy
Block opening of PDFs received from external senders until patches are applied across the environment

bash

# Disable JavaScript in Adobe Acrobat Reader via Windows Registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f