CVE-2026-47937: Acrobat Reader RCE Vulnerability

CVE-2026-47937 Overview

CVE-2026-47937 is an Uncontrolled Search Path Element vulnerability [CWE-427] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Exploitation requires user interaction and local access, but the scope is changed, meaning successful exploitation impacts resources beyond the vulnerable component. Adobe published the issue under security advisory APSB26-63.

Critical Impact
Successful exploitation enables arbitrary code execution as the current user, with a scope change that extends impact beyond the Acrobat Reader process boundary.

Affected Products

Adobe Acrobat Reader 24.001.30365 and earlier
Adobe Acrobat Reader 26.001.21651 and earlier
Acrobat Reader installations on Windows and macOS endpoints

Discovery Timeline

2026-06-09 - CVE-2026-47937 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47937

Vulnerability Analysis

The vulnerability is classified as an Uncontrolled Search Path Element [CWE-427]. Acrobat Reader resolves a library or resource without enforcing a fully qualified path, allowing the operating system loader to search attacker-controlled locations. When a victim opens a crafted file, the application loads a malicious binary from a directory the attacker controls. Code executes within the security context of the user running Acrobat Reader. The advisory notes a scope change, indicating that the impact crosses the trust boundary of the vulnerable component.

Root Cause

The root cause is improper control over the search path used during dynamic library or module resolution. Acrobat Reader trusts directories that may be writable by lower-privileged users or co-located with untrusted documents. This pattern is commonly known as DLL hijacking on Windows or dylib hijacking on macOS. Without an absolute path or signature verification, the loader resolves to the attacker-supplied module.

Attack Vector

The attack vector is local and requires high privileges to stage the malicious binary, plus user interaction to open the crafted file. An attacker plants a malicious library in a directory searched by Acrobat Reader, then delivers a PDF or companion file that triggers the load. When the victim opens the file, Acrobat Reader loads the planted module and executes attacker code. The scope change reflects that the executed code can affect resources beyond the Acrobat process, such as elevated components or shared system resources.

No verified public proof-of-concept code is available. See the Adobe Security Advisory APSB26-63 for vendor technical details.

Detection Methods for CVE-2026-47937

Indicators of Compromise

Unsigned or unexpected DLL/dylib files placed in directories adjacent to Acrobat Reader executables or recently opened PDF locations
Acrobat Reader (AcroRd32.exe, Acrobat.exe) loading modules from user-writable paths such as %TEMP%, %APPDATA%, or Downloads
Child processes spawned by Acrobat Reader that perform reconnaissance, credential access, or network beaconing

Detection Strategies

Monitor process creation events where Acrobat Reader is the parent of cmd.exe, powershell.exe, rundll32.exe, or other living-off-the-land binaries
Track image load events from Acrobat Reader and flag loads originating outside Program Files or signed installation directories
Correlate PDF file open events with subsequent module loads from the same directory as the document

Monitoring Recommendations

Enable Sysmon Event ID 7 (ImageLoad) and Event ID 1 (ProcessCreate) with filters scoped to Acrobat Reader binaries
Forward endpoint telemetry to a centralized data lake for retroactive hunting on library load anomalies
Audit user Downloads, Desktop, and Temp directories for paired PDF and library file artifacts

How to Mitigate CVE-2026-47937

Immediate Actions Required

Apply the Adobe security updates referenced in advisory APSB26-63 to all Acrobat Reader installations
Inventory endpoints running affected versions 24.001.30365, 26.001.21651, and earlier, prioritizing systems handling untrusted documents
Restrict write permissions on directories searched by Acrobat Reader to prevent library planting

Patch Information

Adobe has released fixed versions through security advisory APSB26-63. Administrators should consult the Adobe Security Advisory APSB26-63 for the patched version numbers and download locations. Deploy updates via enterprise software distribution or the Adobe update channel.

Workarounds

Block opening of PDF files from untrusted sources via email gateway and web proxy policies
Enable Acrobat Reader Protected View and Protected Mode to sandbox document rendering
Apply application control policies that allow Acrobat Reader to load only signed libraries from trusted installation paths

bash

# Example AppLocker DLL rule (PowerShell) to restrict Acrobat module loads to Program Files
New-AppLockerPolicy -RuleType Path -User Everyone -Action Allow `
  -Path "%PROGRAMFILES%\Adobe\Acrobat*\*" `
  -RuleNamePrefix "AcrobatTrustedDLL"