CVE-2026-47918: Acrobat Reader RCE Vulnerability

CVE-2026-47918 Overview

CVE-2026-47918 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Exploitation requires user interaction, limiting unattended attack chains but aligning with common phishing delivery techniques.

Adobe published a security patch addressing the issue under advisory APSB26-63. The vulnerability carries a local attack vector with high impact across confidentiality, integrity, and availability.

Critical Impact
A crafted PDF can trigger memory reuse after release in Acrobat Reader, leading to arbitrary code execution under the user's privileges.

Affected Products

Adobe Acrobat Reader 24.001.30365 and earlier
Adobe Acrobat Reader 26.001.21651 and earlier
Adobe Acrobat (corresponding tracks per APSB26-63)

Discovery Timeline

2026-06-09 - CVE-2026-47918 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47918

Vulnerability Analysis

The vulnerability is a Use After Free condition in Adobe Acrobat Reader's document processing logic. A Use After Free occurs when an application continues to reference memory after the underlying object has been freed. Attackers craft PDF content that forces Acrobat Reader to release an object while a dangling pointer still references it.

When Acrobat Reader subsequently dereferences the stale pointer, an attacker-controlled object can occupy the freed slot. This primitive enables arbitrary read/write or control of a virtual function pointer, leading to arbitrary code execution in the user's security context. Refer to the Adobe Acrobat Security Patch advisory for vendor technical details.

Root Cause

The root cause is improper object lifetime management within Acrobat Reader. The application frees an internal object but retains a reference to it. Subsequent operations on that reference invoke methods or read fields on freed memory, producing exploitable behavior tracked under [CWE-416].

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious PDF through email, instant messaging, web download, or shared storage. When the victim opens the file in a vulnerable Acrobat Reader version, the crafted objects trigger the freed-memory access path. No authentication is required, and exploitation yields code execution as the current user.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing is associated with this CVE at publication.

Detection Methods for CVE-2026-47918

Indicators of Compromise

Acrobat Reader processes (AcroRd32.exe, Acrobat.exe) spawning command interpreters such as cmd.exe, powershell.exe, or wscript.exe.
PDF files arriving from untrusted senders that reference unusual JavaScript, embedded fonts, or malformed object streams.
Crash dumps or Windows Error Reporting events indicating access violations within Acrobat Reader modules.

Detection Strategies

Hunt for child processes of Acrobat Reader that perform reconnaissance, file staging, or network egress.
Inspect PDF samples with static analyzers for suspicious object reuse patterns, malformed cross-reference tables, or heavy JavaScript usage.
Correlate user-opened email attachments with subsequent endpoint process anomalies within short time windows.

Monitoring Recommendations

Forward endpoint process, image-load, and file-write telemetry to a centralized analytics platform for retrospective hunting.
Alert on Acrobat Reader modules loading unsigned DLLs or writing executables to user-writable paths such as %APPDATA% and %TEMP%.
Track Acrobat Reader version inventory to identify hosts running 24.001.30365, 26.001.21651, or earlier builds.

How to Mitigate CVE-2026-47918

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB26-63 to all Acrobat and Acrobat Reader installations.
Inventory endpoints and prioritize patching for users who routinely open externally sourced PDF documents.
Restrict execution of PDF attachments from untrusted senders at the email gateway until patching completes.

Patch Information

Adobe released fixed versions through the Adobe Acrobat Security Patch advisory. Administrators should deploy the updates via Adobe's enterprise update channels, SCCM, Intune, or equivalent management tooling.

Workarounds

Enable Acrobat Reader's Protected View and Protected Mode to sandbox untrusted PDF rendering.
Disable JavaScript in Acrobat Reader through Preferences or enterprise policy to reduce exploitation surface.
Configure file associations so that PDFs from external sources open in a hardened viewer or browser sandbox.

bash

# Configuration example: disable JavaScript in Acrobat Reader via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for files originating from untrusted locations
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f