CVE-2026-79910: Adobe Acrobat Information Disclosure Flaw

CVE-2026-79910 Overview

CVE-2026-79910 is an out-of-bounds read vulnerability [CWE-125] in Adobe Acrobat and Acrobat Reader. The flaw allows an attacker to read memory beyond the intended buffer boundaries, potentially exposing sensitive process memory. Exploitation requires a victim to open a maliciously crafted file, making user interaction a prerequisite for successful attacks.

The vulnerability affects Adobe Acrobat, Acrobat DC, and Acrobat Reader DC on both Microsoft Windows and Apple macOS platforms. Adobe published Security Advisory APSB26-141 addressing this issue along with other bulletins in the same release cycle.

Critical Impact
Successful exploitation discloses sensitive memory contents from the Acrobat process, which attackers can use to bypass Address Space Layout Randomization (ASLR) and chain with other vulnerabilities.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC (Continuous track)
Adobe Acrobat Reader DC (Continuous track) on Microsoft Windows and Apple macOS

Discovery Timeline

2026-09-08 - CVE-2026-79910 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-79910

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition in Adobe Acrobat and Acrobat Reader when parsing crafted document content. When the affected code path processes an untrusted file, it reads memory outside the boundaries of the allocated buffer. The result is disclosure of adjacent process memory back to attacker-controlled logic within the PDF renderer.

The attack vector is local and requires user interaction. A victim must open a malicious file for exploitation to occur. Successful exploitation impacts confidentiality only, with no direct integrity or availability impact reflected in the CVSS vector.

Information disclosure vulnerabilities like this one are frequently paired with memory corruption bugs to defeat modern mitigations. Attackers use leaked pointers to locate loaded modules and bypass ASLR before triggering a separate code execution primitive.

Root Cause

The root cause is improper validation of length or index values when reading structured data from a PDF file. The Acrobat parser trusts a size or offset derived from attacker-controlled input and reads past the end of an allocated object. This class of defect is tracked as CWE-125: Out-of-bounds Read.

Attack Vector

An attacker delivers a malicious PDF to a victim through email, a web download, or a shared file location. When the victim opens the file in an unpatched Acrobat or Acrobat Reader installation, the malformed content triggers the out-of-bounds read. Sensitive memory contents may then be exfiltrated through embedded JavaScript, form submission, or subsequent chained exploitation.

See the Adobe Security Advisory APSB26-141 for technical references and affected version ranges.

Detection Methods for CVE-2026-79910

Indicators of Compromise

PDF files arriving from untrusted sources that contain malformed or unusual object streams, xref tables, or embedded JavaScript.
Acrobat or Acrobat Reader processes spawning unexpected child processes or performing outbound network connections shortly after opening a document.
Crash telemetry or Windows Error Reporting (WER) entries referencing AcroRd32.exe or Acrobat.exe with access violation faults.

Detection Strategies

Inspect inbound email attachments and web downloads for PDF files and apply sandbox detonation against untrusted samples.
Correlate endpoint telemetry for Acrobat processes reading from user download directories immediately followed by network egress.
Monitor for anomalous JavaScript execution within PDF context using endpoint behavioral analytics.

Monitoring Recommendations

Track installed versions of Adobe Acrobat and Acrobat Reader across the estate and alert on hosts running versions prior to the APSB26-141 fix.
Enable Protected View and Protected Mode logging in Acrobat and forward events to a centralized logging pipeline.
Establish behavioral baselines for Acrobat process activity so deviations trigger investigation.

How to Mitigate CVE-2026-79910

Immediate Actions Required

Apply the updates listed in Adobe Security Advisory APSB26-141 to all affected Windows and macOS endpoints.
Inventory installations of Adobe Acrobat, Acrobat DC, and Acrobat Reader DC and prioritize patching workstations that handle external documents.
Restrict opening of PDF files from untrusted sources until patches are deployed.

Patch Information

Adobe addressed CVE-2026-79910 in the security update documented in bulletin APSB26-141. Administrators should consult the advisory for the specific fixed build numbers for the Classic and Continuous release tracks, and deploy through their standard software update mechanism or Adobe's enterprise update channels.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations to sandbox parsing operations.
Disable JavaScript execution in Acrobat and Acrobat Reader through the Preferences dialog or enterprise policy to reduce exploitability of chained attacks.
Use email gateway policies to block or quarantine unexpected PDF attachments from external senders.

bash

# Configuration example: disable JavaScript in Adobe Acrobat via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f