CVE-2026-47920 Overview
CVE-2026-47920 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Exploitation requires local user interaction, making weaponized PDF documents the most likely delivery vector. Adobe published the corresponding security advisory tracked as APSB26-63.
Critical Impact
Successful exploitation grants attackers arbitrary code execution under the privileges of the user opening the crafted PDF, enabling malware deployment, credential theft, or lateral movement.
Affected Products
- Adobe Acrobat Reader 24.001.30365 and earlier
- Adobe Acrobat Reader 26.001.21651 and earlier
- Adobe Acrobat (corresponding tracks per APSB26-63)
Discovery Timeline
- 2026-06-09 - CVE-2026-47920 published to the National Vulnerability Database
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47920
Vulnerability Analysis
The vulnerability is a Use After Free condition [CWE-416] in Adobe Acrobat Reader's document processing logic. Use After Free flaws occur when a program continues to reference memory after it has been freed. When the freed memory is reallocated with attacker-controlled data, dereferencing the stale pointer can redirect execution flow.
In this case, processing a malicious PDF triggers premature object deallocation while a reference to that object remains in use. An attacker who shapes the heap to reclaim the freed allocation can achieve arbitrary code execution within the Reader process. Code runs with the privileges of the current user, which on most workstations includes access to user documents, browser session data, and network resources.
Root Cause
The root cause is improper object lifetime management within Acrobat Reader's parsing or rendering routines. A code path frees an internal object without invalidating all outstanding references. Subsequent operations dereference the dangling pointer, reading or writing into memory that may now contain attacker-controlled bytes.
Attack Vector
The attack vector is local with required user interaction. An attacker delivers a crafted PDF through phishing email, drive-by download, or shared file repositories. When the victim opens the document in a vulnerable version of Acrobat Reader, the embedded objects trigger the Use After Free condition and execute the attacker payload. No authentication is required on the target system.
Verified proof-of-concept code is not publicly available at this time. Refer to the Adobe Acrobat Security Advisory APSB26-63 for vendor technical details.
Detection Methods for CVE-2026-47920
Indicators of Compromise
- Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, particularly cmd.exe, powershell.exe, or rundll32.exe
- PDF files with embedded JavaScript or malformed object streams arriving via email attachments or web downloads
- Outbound network connections initiated by Acrobat Reader processes to unfamiliar domains shortly after a document is opened
Detection Strategies
- Monitor process creation events where the parent image is Acrobat Reader and the child is a scripting or living-off-the-land binary
- Inspect endpoint memory telemetry for crash events, access violations, or heap corruption signatures inside the Reader process
- Hunt for PDF documents containing suspicious JavaScript actions, embedded files, or unusually structured object trees in mail and web gateways
Monitoring Recommendations
- Centralize Acrobat Reader application crash logs and correlate with email delivery and web download events
- Track installed Acrobat Reader versions across the fleet and flag endpoints running builds at or below 24.001.30365 and 26.001.21651
- Alert on Reader processes performing file writes outside user document directories or modifying autorun registry keys
How to Mitigate CVE-2026-47920
Immediate Actions Required
- Apply the Adobe security update referenced in APSB26-63 to all systems running Acrobat and Acrobat Reader
- Inventory endpoints to identify versions 24.001.30365, 26.001.21651, and earlier, prioritizing user workstations
- Block or quarantine PDF attachments from untrusted senders at the email gateway until patching is complete
Patch Information
Adobe has released fixed versions for the affected Acrobat and Acrobat Reader tracks. Consult the Adobe Acrobat Security Advisory for the exact patched build numbers and download locations. Enable automatic updates within Acrobat Reader to receive future security fixes promptly.
Workarounds
- Enable Protected View and Protected Mode in Acrobat Reader to sandbox PDF rendering
- Disable JavaScript execution in Acrobat Reader via Preferences > JavaScript > Enable Acrobat JavaScript
- Restrict execution of Acrobat Reader through application control policies until patches are deployed
# Disable Acrobat JavaScript via Windows registry (per-user)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
