CVE-2026-47921: Acrobat Reader RCE Vulnerability

CVE-2026-47921 Overview

CVE-2026-47921 is a Use After Free vulnerability [CWE-416] in Adobe Acrobat Reader. The flaw affects Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier releases. Successful exploitation allows arbitrary code execution in the context of the current user. The attack requires local access and user interaction, as the victim must open a crafted malicious file. Adobe published a security advisory documenting the issue and providing remediation guidance.

Critical Impact

An attacker who convinces a user to open a malicious PDF can execute arbitrary code with the privileges of the current user, enabling malware installation, data theft, or follow-on compromise.

Affected Products

• Adobe Acrobat Reader 24.001.30365 and earlier
• Adobe Acrobat Reader 26.001.21651 and earlier
• Adobe Acrobat (matching code base versions)

Discovery Timeline

• 2026-06-09 - CVE-2026-47921 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47921

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] in Adobe Acrobat Reader's document processing logic. A Use After Free occurs when a program continues to reference memory after it has been freed. Attackers can place attacker-controlled data into the reclaimed memory region. When Acrobat Reader subsequently dereferences the stale pointer, attacker-controlled data is interpreted as a valid object. This primitive enables hijacking of program control flow and arbitrary code execution in the context of the current user.

The attack vector is local and requires user interaction. The victim must open a malicious PDF document delivered through phishing, drive-by download, or shared file storage. No elevated privileges are needed to trigger the flaw.

Root Cause

The root cause is improper object lifetime management within Acrobat Reader's PDF parsing or rendering pipeline. An object is freed while a reference to it remains in use, allowing a subsequent operation to dereference the dangling pointer. Adobe has not publicly disclosed the specific component or function involved.

Attack Vector

An attacker crafts a malicious PDF that triggers the Use After Free condition during parsing or rendering. The attacker delivers the file via email attachment, malicious website, or other distribution channel. When the victim opens the document in a vulnerable Acrobat Reader version, the freed memory is reallocated with attacker-controlled content. Code execution occurs within the user's security context.

No verified public proof-of-concept code is available. See the Adobe Acrobat Security Advisory for vendor technical details.

Detection Methods for CVE-2026-47921

Indicators of Compromise

• Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, such as cmd.exe, powershell.exe, or wscript.exe
• Crashes or abnormal terminations of Acrobat Reader correlated with the opening of untrusted PDF files
• Outbound network connections originating from Acrobat Reader processes to untrusted destinations
• Suspicious file writes by Acrobat Reader to user-writable locations such as %TEMP% or %APPDATA%

Detection Strategies

• Monitor process lineage for Acrobat Reader spawning interpreters, shells, or LOLBins
• Hunt for PDF files arriving from external email senders followed by anomalous endpoint behavior
• Correlate Acrobat Reader crash events in the Windows Application event log with subsequent process creation or persistence activity

Monitoring Recommendations

• Enable detailed process creation logging (Sysmon Event ID 1, Windows Event ID 4688) with command-line capture
• Forward endpoint telemetry to a centralized SIEM for correlation across users and assets
• Track Acrobat Reader version inventory to identify endpoints running vulnerable builds

How to Mitigate CVE-2026-47921

Immediate Actions Required

• Apply Adobe's security updates to Acrobat Reader on all affected endpoints as the primary remediation
• Inventory all installations of Acrobat Reader and prioritize patching for systems handling externally sourced documents
• Restrict opening of PDF files from untrusted sources until patches are deployed

Patch Information

Adobe has released updated versions of Acrobat Reader that remediate this vulnerability. Refer to the Adobe Acrobat Security Advisory APSB26-63 for the fixed version numbers and download links. Apply the update through Acrobat Reader's built-in updater or enterprise deployment tooling.

Workarounds

• Enable Protected View and Protected Mode in Acrobat Reader to sandbox untrusted documents
• Block or quarantine PDF attachments from external senders at the email gateway pending patch deployment
• Use Group Policy to disable JavaScript execution within Acrobat Reader where business processes allow

# Example: disable JavaScript in Acrobat Reader via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f