CVE-2026-79909 Overview
CVE-2026-79909 is a use-after-free vulnerability [CWE-416] in Adobe Acrobat and Acrobat Reader. An attacker who convinces a victim to open a malicious PDF can trigger memory reuse conditions that lead to arbitrary code execution in the context of the current user. The flaw affects Acrobat Classic, Acrobat DC Continuous, and Acrobat Reader DC Continuous on both Microsoft Windows and Apple macOS. Adobe disclosed the issue in security bulletin APSB26-141 and released fixed builds for all affected tracks. No public proof-of-concept exploit is available, and CISA has not added CVE-2026-79909 to the Known Exploited Vulnerabilities catalog.
Critical Impact
Successful exploitation grants arbitrary code execution under the user's privileges, enabling malware installation, credential theft, and lateral movement from a single opened PDF.
Affected Products
- Adobe Acrobat (Classic track)
- Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
- Adobe Acrobat / Reader on Microsoft Windows and Apple macOS
Discovery Timeline
- 2026-09-08 - CVE-2026-79909 published to the National Vulnerability Database
- 2026-09-10 - CVE record last modified in NVD
Technical Details for CVE-2026-79909
Vulnerability Analysis
The issue is a use-after-free defect in the Acrobat rendering engine. Acrobat processes rich PDF constructs such as JavaScript actions, form fields, embedded fonts, and annotations. When object lifetimes are mismanaged, the parser can free an object while another reference still points to the same memory region. Subsequent access dereferences a dangling pointer, allowing an attacker who controls surrounding heap contents to hijack execution flow.
Exploitation requires user interaction. A victim must open a crafted PDF delivered through phishing, a compromised website, or file-sharing channels. Because Acrobat runs in the user's security context, successful exploitation inherits that user's permissions. On workstations where users hold local administrator rights, the blast radius includes persistence, credential access, and lateral movement to file shares.
Root Cause
The root cause is improper object lifetime management inside Acrobat's document processing code. The application releases a heap-allocated structure while a stale reference remains reachable. When code later dereferences that reference, the freed memory may contain attacker-controlled data groomed through JavaScript or object streams inside the PDF.
Attack Vector
The attack vector is local file processing. The attacker crafts a PDF that triggers the vulnerable code path and delivers it to the target. Opening the file in a vulnerable Acrobat or Reader build initiates the free-then-reuse sequence. No network authentication is required, and no elevated privileges are needed before exploitation.
No verified exploit code is public for CVE-2026-79909. See the Adobe Security Advisory APSB26-141 for vendor-supplied technical context.
Detection Methods for CVE-2026-79909
Indicators of Compromise
- PDF files opened by AcroRd32.exe or Acrobat.exe immediately preceding unexpected child process creation such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
- Acrobat processes writing executables, scripts, or scheduled task artifacts into user-writable directories such as %APPDATA%, %LOCALAPPDATA%, or /Users/<user>/Library/.
- Outbound network connections from Acrobat processes to previously unseen domains shortly after a PDF is opened.
Detection Strategies
- Deploy EDR rules that flag Acrobat processes spawning shells, script interpreters, or LOLBins.
- Alert on Acrobat crash telemetry with access-violation signatures, since use-after-free exploitation often produces distinctive crash traces during development or unreliable exploitation.
- Correlate email gateway metadata with endpoint file-open events to identify PDFs delivered via phishing that trigger anomalous Acrobat behavior.
Monitoring Recommendations
- Ingest Acrobat process telemetry, Windows Sysmon ProcessCreate and FileCreate events, and macOS Endpoint Security framework events into a central analytics store.
- Track Acrobat and Reader versions across the fleet and flag hosts running builds predating the APSB26-141 fixes.
- Monitor for large or obfuscated JavaScript objects embedded in PDFs at the mail and web proxy layer.
How to Mitigate CVE-2026-79909
Immediate Actions Required
- Apply the Acrobat and Reader updates referenced in Adobe bulletin APSB26-141 to all Windows and macOS endpoints.
- Prioritize patching for users who routinely open externally sourced PDFs, including finance, HR, legal, and executive staff.
- Reinforce phishing awareness training focused on unsolicited PDF attachments and download prompts.
Patch Information
Adobe published fixed builds for Acrobat Classic, Acrobat DC Continuous, and Acrobat Reader DC Continuous. Refer to the Adobe Security Advisory APSB26-141 for the exact fixed version numbers per track and platform, and deploy through your standard patch management workflow.
Workarounds
- Enable Acrobat's Protected View and Protected Mode to sandbox document rendering on Windows.
- Disable JavaScript execution in Acrobat and Reader via Preferences > JavaScript where business workflows allow.
- Block or quarantine inbound PDFs containing embedded JavaScript at the email gateway pending patch deployment.
- Enforce least-privilege user accounts so successful exploitation does not yield administrative access.
# Example: disable Acrobat JavaScript via Windows registry (per-user)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
