CVE-2026-79908: Adobe Acrobat RCE Vulnerability

CVE-2026-79908 Overview

CVE-2026-79908 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. Attackers can achieve arbitrary code execution in the context of the current user by crafting a malicious PDF file. Exploitation requires user interaction, specifically the victim opening the weaponized document. Adobe published the fix in security bulletin APSB26-141 on the September 2026 patch cycle.

Critical Impact
Successful exploitation grants attackers the ability to execute arbitrary code with the privileges of the user opening the malicious PDF, enabling full compromise of the user session, credential theft, and lateral movement.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Apple macOS and Microsoft Windows platforms running the affected Adobe versions

Discovery Timeline

2026-09-08 - CVE-2026-79908 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-79908

Vulnerability Analysis

CVE-2026-79908 is an out-of-bounds write flaw in Adobe Acrobat and Acrobat Reader. Out-of-bounds write defects allow a process to modify memory outside the intended buffer boundaries. In parsers like Acrobat, this typically stems from incorrect length calculations while processing structured file elements such as fonts, images, streams, or JavaScript objects embedded in a PDF.

An attacker weaponizes a PDF so that a specific object triggers the faulty write path. When the victim opens the document in a vulnerable Acrobat build, the parser writes attacker-controlled bytes past the allocated region. That write can corrupt adjacent objects, function pointers, or virtual table entries, redirecting execution flow to attacker-supplied code.

Because the attack executes under the current user account, the resulting session inherits every right and token that user holds. On enterprise workstations, this frequently includes access to email, cached credentials, VPN tunnels, and internal file shares.

Root Cause

The root cause is improper validation of an input length or index during PDF parsing, allowing a write past the bounds of a heap-allocated buffer. Adobe has not published low-level technical detail beyond the bulletin classification.

Attack Vector

The attack vector is local file processing with required user interaction. An attacker delivers the malicious PDF through phishing email, watering-hole downloads, instant messaging, or removable media. The exploit fires when the user opens the file in a vulnerable Acrobat or Reader build. No elevated privileges are required prior to exploitation.

The vulnerability mechanism is described in the Adobe Acrobat Security Update APSB26-141. No public proof-of-concept or in-the-wild exploitation has been confirmed at publication.

Detection Methods for CVE-2026-79908

Indicators of Compromise

Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, particularly command interpreters (cmd.exe, powershell.exe) or scripting hosts (wscript.exe, mshta.exe).
Acrobat writing executable files, DLLs, or scripts into user-writable directories such as %APPDATA%, %TEMP%, or ~/Library/Application Support.
Outbound network connections initiated directly by Acrobat processes to previously unseen external hosts shortly after a PDF is opened.
PDF files containing malformed streams, obfuscated JavaScript, or unusually large embedded object dictionaries arriving through email gateways.

Detection Strategies

Deploy behavioral endpoint detection rules that alert on process-injection patterns and suspicious child-process creation originating from Acrobat binaries.
Correlate email gateway telemetry with endpoint execution events to trace weaponized PDFs from delivery to detonation.
Use YARA rules on mail and file storage to flag PDFs that combine JavaScript actions with abnormal object stream structures.

Monitoring Recommendations

Monitor Acrobat process creation events (Sysmon Event ID 1) and file write events (Event ID 11) for the AcroRd32.exe and Acrobat.exe images.
Track installed Acrobat versions across the fleet and alert when hosts remain on builds prior to those listed in APSB26-141.
Log DNS and HTTP egress from workstations opening PDF attachments to identify staging or command-and-control callbacks.

How to Mitigate CVE-2026-79908

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-141 to all Acrobat and Acrobat Reader installations across Windows and macOS.
Inventory endpoints running Acrobat DC Continuous, Acrobat Classic, and Reader DC, and prioritize patching systems that process externally sourced PDFs.
Restrict opening of PDFs from untrusted sources until patching is confirmed, using email attachment filtering and browser download policies.

Patch Information

Adobe released fixed builds in the Adobe Acrobat Security Update APSB26-141. Administrators should deploy the updates through Adobe Admin Console, Microsoft Intune, Jamf, SCCM, or the Adobe Remote Update Manager. Verify installation by checking the Acrobat Help > About version string against the versions listed in the bulletin.

Workarounds

Enable Acrobat Protected View for files originating from the internet and potentially unsafe locations to contain parser exploitation.
Disable JavaScript execution in Acrobat through the preferences setting Edit > Preferences > JavaScript > Enable Acrobat JavaScript where operationally acceptable.
Block inbound PDF attachments at the mail gateway from external senders lacking DMARC alignment until endpoints are patched.

bash

# Windows: disable Acrobat JavaScript via registry across managed endpoints
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Windows: force Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f