CVE-2026-47919: Acrobat Reader RCE Vulnerability

CVE-2026-47919 Overview

CVE-2026-47919 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious PDF file. Exploitation requires user interaction, limiting the attack to local file-handling scenarios.

Adobe addressed the issue in an out-of-band security update tracked as APSB26-63. The vulnerability carries a CVSS 3.1 base score of 7.8 and is rated HIGH severity by NVD.

Critical Impact
Successful exploitation grants attackers arbitrary code execution in the context of the current user, enabling malware installation, credential theft, or lateral movement from a single weaponized PDF.

Affected Products

Adobe Acrobat Reader 24.001.30365 and earlier (Classic track)
Adobe Acrobat Reader 26.001.21651 and earlier (Continuous track)
Adobe Acrobat (corresponding versions per APSB26-63)

Discovery Timeline

2026-06-09 - CVE-2026-47919 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47919

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] in Adobe Acrobat Reader. Use After Free flaws occur when a program continues to reference memory after that memory has been released back to the allocator. Attackers can re-allocate the freed region with attacker-controlled data, causing the dangling pointer to dereference a crafted object.

When Acrobat Reader processes a malicious PDF containing crafted objects, the parser frees an internal object while another code path retains a stale reference to it. Subsequent operations on the dangling pointer transfer execution to attacker-controlled data. The result is arbitrary code execution in the security context of the user running Acrobat Reader.

The attack vector is local and requires user interaction. A victim must open the malicious file, typically delivered through phishing email, instant messaging, or a drive-by download. Standard Acrobat sandbox mitigations apply, but Use After Free primitives in the renderer are a well-known path to sandbox-internal code execution and have historically been chained with sandbox escapes.

Root Cause

The root cause is incorrect object lifetime management within Acrobat Reader's PDF processing code. A reference to a heap-allocated object persists after the object has been freed, and a later operation dereferences that stale pointer. Adobe's advisory APSB26-63 does not publicly disclose the specific component affected.

Attack Vector

An attacker crafts a PDF document containing structures that trigger the vulnerable code path. The attacker delivers the file to a victim through email attachments, malicious links, or compromised file-sharing platforms. When the victim opens the document in a vulnerable Acrobat Reader build, the Use After Free condition fires and shellcode embedded in the document executes with the user's privileges.

No proof-of-concept exploit is publicly available at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.033%, indicating a low predicted exploitation probability in the short term. See the Adobe Acrobat Security Update APSB26-63 for vendor technical context.

Detection Methods for CVE-2026-47919

Indicators of Compromise

Acrobat Reader process (AcroRd32.exe or Acrobat.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
Acrobat Reader crashes with access violation exceptions immediately after opening a PDF, particularly heap-related faults consistent with Use After Free.
PDF files containing heavily obfuscated JavaScript, malformed object streams, or unusual cross-reference tables arriving via email or external sources.

Detection Strategies

Hunt for parent-child process relationships where Acrobat Reader launches script interpreters, LOLBins, or network utilities.
Monitor for Acrobat Reader writing executable files (.exe, .dll, .scr) or scripts to user-writable paths such as %TEMP% and %APPDATA%.
Inspect inbound email attachments and web downloads for PDFs and correlate with subsequent endpoint behavior on the receiving host.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office and PDF applications from creating child processes, and forward telemetry to your SIEM.
Track Acrobat Reader version inventory across the fleet and alert when hosts run versions at or below 24.001.30365 and 26.001.21651.
Baseline normal Acrobat Reader network activity and alert on outbound connections to uncategorized or newly registered domains following PDF open events.

How to Mitigate CVE-2026-47919

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions published in Adobe Security Bulletin APSB26-63.
Prioritize patching for users who routinely handle external PDFs, including finance, legal, HR, and executive staff.
Block or quarantine inbound PDF attachments from untrusted senders at the email gateway until patching is complete.

Patch Information

Adobe released patches for this vulnerability in security bulletin APSB26-63. Administrators should deploy the updated builds through Adobe's enterprise update channels, Microsoft Intune, SCCM, or other managed software distribution tooling. Confirm the installed version exceeds 24.001.30365 for the Classic track and 26.001.21651 for the Continuous track.

Workarounds

Disable JavaScript execution in Acrobat Reader via Edit > Preferences > JavaScript or the corresponding registry policy to reduce attack surface.
Enable Protected View and Protected Mode for all files originating from the internet and from potentially unsafe locations.
Restrict PDF rendering to a hardened browser-based viewer for untrusted documents until endpoints receive the vendor patch.

bash

# Configuration example: enforce Protected View and disable JavaScript via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\Privileged" /v bProtectedMode /t REG_DWORD /d 1 /f