CVE-2026-47959: Acrobat Reader RCE Vulnerability

CVE-2026-47959 Overview

CVE-2026-47959 is a stack-based buffer overflow [CWE-121] affecting Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier. The vulnerability allows attackers to execute arbitrary code in the context of the current user. Exploitation requires the victim to open a malicious file crafted by the attacker. Adobe published the corresponding advisory APSB26-63 to address the issue.

The flaw carries a CVSS 3.1 base score of 7.8 with local attack vector and required user interaction. No public exploit code is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the user opening a malicious document, enabling malware installation, data theft, and lateral movement opportunities.

Affected Products

Adobe Acrobat Reader 24.001.30365 and earlier
Adobe Acrobat Reader 26.001.21651 and earlier
Adobe Acrobat (corresponding builds covered by Adobe Security Advisory APSB26-63)

Discovery Timeline

2026-06-09 - CVE-2026-47959 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47959

Vulnerability Analysis

CVE-2026-47959 is classified under [CWE-121] Stack-based Buffer Overflow. The vulnerability resides in Acrobat Reader's parsing logic for crafted document content. When the application processes a malformed file, attacker-controlled data overruns a fixed-size stack buffer, corrupting adjacent stack memory including saved return addresses and structured exception handler records.

An attacker who controls the contents written past the buffer boundary can redirect execution flow. On modern Windows builds, exploitation typically requires bypassing stack canaries, Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR). Successful exploitation yields code execution under the user account that opened the file.

Root Cause

The root cause is missing or incorrect bounds checking when copying data from an untrusted PDF object into a stack-allocated buffer. Adobe has not published low-level technical details of the affected parser routine. Refer to Adobe Security Advisory APSB26-63 for vendor-supplied information.

Attack Vector

Exploitation requires user interaction. An attacker delivers a malicious PDF through phishing email, a watering-hole website, a chat platform, or any vector that convinces the victim to open the file in a vulnerable Acrobat Reader build. Opening the document triggers the overflow during parsing, granting the attacker code execution in the victim's session.

The local attack vector designation reflects that the malicious content must be processed locally by Acrobat Reader. The actual delivery is commonly remote.

No verified proof-of-concept code is published. See the Adobe Security Advisory for vendor remediation details.

Detection Methods for CVE-2026-47959

Indicators of Compromise

Acrobat Reader processes (AcroRd32.exe, Acrobat.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Crash dumps or Windows Error Reporting entries showing access violations in Acrobat Reader modules following the opening of an untrusted PDF.
PDF files arriving from external senders with embedded JavaScript, malformed cross-reference tables, or unusually large embedded streams.

Detection Strategies

Monitor process creation events where Acrobat Reader is the parent and the child is a scripting host, shell, or LOLBin.
Inspect endpoint telemetry for memory allocation patterns and exception events generated by Acrobat Reader processes.
Use email and web gateway scanning to flag PDFs with anomalous structure or known exploit signatures.

Monitoring Recommendations

Track Acrobat Reader version inventory across endpoints to identify hosts running 24.001.30365, 26.001.21651, or earlier builds.
Alert on outbound network connections initiated by Acrobat Reader processes immediately after document open events.
Collect and centralize crash telemetry from endpoints to detect mass exploitation attempts targeting the same parser code path.

How to Mitigate CVE-2026-47959

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-63 to all Acrobat Reader and Acrobat installations.
Identify and prioritize patching of endpoints handling external PDFs, including executive workstations and shared kiosks.
Block or quarantine inbound PDFs from untrusted senders at the email gateway until patching is complete.

Patch Information

Adobe has released fixed builds addressing this vulnerability. Administrators should consult Adobe Security Advisory APSB26-63 for the exact patched version numbers and download locations. Enable automatic updates in Acrobat Reader where operationally feasible.

Workarounds

Enable Protected View and Protected Mode (sandbox) in Acrobat Reader to constrain code execution if the overflow is triggered.
Disable JavaScript in Acrobat Reader through Edit > Preferences > JavaScript for environments that do not require it.
Restrict file associations so untrusted PDFs open in a browser-based viewer rather than the Acrobat Reader desktop client.

bash

# Disable JavaScript in Acrobat Reader via registry (Windows)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for files from potentially unsafe locations
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f