CVE-2026-79907 Overview
CVE-2026-79907 is a double free vulnerability [CWE-415] in Adobe Acrobat and Acrobat Reader. The flaw allows attackers to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a maliciously crafted PDF document. The vulnerability affects Acrobat and Acrobat Reader on both Microsoft Windows and Apple macOS platforms. Adobe published an advisory tracking this issue under bulletin APSB26-141.
Critical Impact
Successful exploitation leads to arbitrary code execution with the privileges of the user running Acrobat, enabling malware installation, data theft, or lateral movement from a single opened PDF.
Affected Products
- Adobe Acrobat (Classic track)
- Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
- Microsoft Windows and Apple macOS installations of the above
Discovery Timeline
- 2026-09-08 - CVE-2026-79907 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-79907
Vulnerability Analysis
CVE-2026-79907 is a double free memory corruption issue classified under [CWE-415]. A double free occurs when the same memory region is released to the heap allocator twice. The second free call corrupts internal allocator metadata, including free list pointers and chunk headers. Attackers who control heap layout can turn this corruption into an arbitrary write primitive.
In Acrobat Reader, this class of bug typically arises during parsing of complex PDF structures such as embedded objects, JavaScript actions, form fields, or image streams. When the parser encounters a malformed object, cleanup logic can release the same allocation through two different code paths. A locally opened file is sufficient to reach the vulnerable code, so the attack vector is scored as Local with required user interaction.
Root Cause
The root cause is duplicate release of a heap allocation during object handling in Acrobat's document processing pipeline. Adobe has not published detailed technical internals in the public advisory. The Common Weakness Enumeration category [CWE-415] describes the defect pattern: reference tracking fails to null out a pointer after the first free, and a later cleanup path frees the stale pointer again.
Attack Vector
An attacker delivers a crafted PDF file through email, a web download, a shared drive, or a messaging platform. When the victim opens the file in a vulnerable Acrobat or Acrobat Reader build, the parser triggers the double free. The attacker leverages heap grooming to place attacker-controlled data into the reused allocation. Chained with information disclosure and control-flow hijacking primitives, this yields arbitrary code execution as the current user. No elevated privileges are required for exploitation.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-79907
Indicators of Compromise
- Unexpected crashes of Acrobat.exe or AcroRd32.exe with access violation or heap corruption exceptions in Windows Event Logs
- Acrobat processes spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
- PDF files arriving from untrusted senders that contain embedded JavaScript, unusual object streams, or malformed cross-reference tables
Detection Strategies
- Monitor for anomalous process lineage where Acrobat or Reader is the parent of shell, scripting, or LOLBins processes
- Alert on Acrobat process crashes correlated with recent PDF opens from email or browser download folders
- Inspect PDF files at the mail gateway for suspicious constructs such as /JavaScript, /OpenAction, and heavily obfuscated object streams
Monitoring Recommendations
- Enable command-line and process-creation auditing on endpoints running Adobe Acrobat and Acrobat Reader
- Forward endpoint telemetry to a centralized analytics platform to correlate PDF opens with subsequent suspicious activity
- Track installed Acrobat and Reader versions across the fleet and flag hosts that remain on builds prior to the APSB26-141 fixed releases
How to Mitigate CVE-2026-79907
Immediate Actions Required
- Apply the Adobe security updates referenced in Adobe Security Bulletin APSB26-141 to all Acrobat and Acrobat Reader installations on Windows and macOS
- Prioritize patching for users who routinely open PDF documents from external sources such as legal, finance, and HR teams
- Restrict opening of PDF attachments from unverified senders through mail gateway policies until patches are deployed
Patch Information
Adobe addressed CVE-2026-79907 in the update bundle tracked by APSB26-141. The bulletin covers both the Continuous track (Acrobat DC and Acrobat Reader DC) and the Classic track. Administrators should consult the advisory for the exact fixed build numbers per track and platform, then deploy through Adobe Admin Console, SCCM, Intune, Jamf, or the built-in updater.
Workarounds
- Enable Protected View for all files originating from the internet and other untrusted locations in Acrobat preferences
- Disable JavaScript execution in Acrobat and Reader through the Preferences > JavaScript panel or via enterprise policy
- Use application allowlisting and attack surface reduction rules to block Acrobat from launching child processes such as scripting hosts and shells
# Example: disable Acrobat JavaScript and enforce Protected View via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
