CVE-2026-47917: Acrobat Reader RCE Vulnerability

CVE-2026-47917 Overview

CVE-2026-47917 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. The flaw allows attackers to execute arbitrary code in the context of the current user. Exploitation requires user interaction: a victim must open a malicious PDF file crafted by the attacker. Successful exploitation grants the attacker the same privileges as the local user running Acrobat Reader.

Critical Impact

Attackers can achieve arbitrary code execution on a target system by convincing a user to open a malicious PDF document.

Affected Products

• Adobe Acrobat Reader 24.001.30365 and earlier
• Adobe Acrobat Reader 26.001.21651 and earlier
• All prior versions of Adobe Acrobat Reader in these release branches

Discovery Timeline

• 2026-06-09 - CVE-2026-47917 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47917

Vulnerability Analysis

The vulnerability is a Use After Free condition in Adobe Acrobat Reader's document processing logic. Use After Free issues occur when an application continues to reference memory after it has been freed. Attackers can manipulate the freed memory region to control program flow and execute arbitrary code.

The attack vector is local and requires user interaction. A victim must open a malicious PDF file for exploitation to succeed. Once triggered, the attacker gains code execution at the privilege level of the user running Acrobat Reader. The vulnerability has a low EPSS exploit prediction score, but the impact on confidentiality, integrity, and availability is high upon successful exploitation.

Root Cause

The vulnerability stems from improper memory management within Acrobat Reader's PDF parsing or rendering routines. Specifically, a pointer references an object after the underlying memory has been freed. Crafted PDF structures can trigger the dangling pointer condition. The freed memory can then be reallocated with attacker-controlled data, enabling code flow hijacking.

Attack Vector

An attacker delivers a malicious PDF to the victim through phishing email, malicious web download, or shared file repository. When the victim opens the file in a vulnerable Acrobat Reader version, the embedded PDF objects trigger the Use After Free. The attacker controls the contents of the reused memory and redirects execution to embedded shellcode or a Return-Oriented Programming (ROP) chain. Refer to the Adobe Acrobat Security Advisory for additional technical details.

Detection Methods for CVE-2026-47917

Indicators of Compromise

• Acrobat Reader process (AcroRd32.exe or Acrobat.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
• Unexpected outbound network connections initiated by Acrobat Reader following a PDF open event
• PDF files containing obfuscated JavaScript, unusual object streams, or malformed cross-reference tables
• Crash dumps or Windows Error Reporting events referencing Acrobat Reader modules

Detection Strategies

• Monitor process creation events where Adobe Acrobat Reader is the parent of script interpreters or living-off-the-land binaries
• Inspect inbound email attachments and web downloads for PDF files with embedded JavaScript or suspicious stream objects
• Apply Endpoint Detection and Response (EDR) behavioral rules for memory corruption patterns in PDF readers
• Correlate user-opened document events with subsequent anomalous process or network activity

Monitoring Recommendations

• Enable detailed process and command-line auditing on endpoints running Acrobat Reader
• Forward Acrobat Reader telemetry, including crashes and module loads, to a centralized SIEM for analysis
• Track Acrobat Reader version inventory across the environment to identify unpatched hosts
• Alert on Acrobat Reader processes accessing sensitive directories or credential stores

How to Mitigate CVE-2026-47917

Immediate Actions Required

• Apply the Adobe security update referenced in APSB26-63 to all affected installations
• Inventory all endpoints running Acrobat Reader and prioritize patching of high-risk users such as executives and finance personnel
• Restrict opening of PDF files from untrusted sources through email filtering and web gateway policies
• Enable Protected View and Protected Mode in Acrobat Reader to sandbox document processing

Patch Information

Adobe has released security updates addressing CVE-2026-47917. Administrators should upgrade Adobe Acrobat Reader to versions later than 24.001.30365 and 26.001.21651 as specified in the Adobe Acrobat Security Advisory APSB26-63. Verify patch deployment through software inventory tools.

Workarounds

• Disable JavaScript execution within Acrobat Reader through the application preferences
• Configure Acrobat Reader to open all documents in Protected View by default
• Use Group Policy to enforce Acrobat Reader security configurations across managed endpoints
• Block PDF attachments at the email gateway from untrusted external senders pending patch deployment

# Example: Disable JavaScript in Acrobat Reader via Windows Registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f