CVE-2026-80159 Overview
CVE-2026-80159 is an Untrusted Search Path vulnerability [CWE-426] affecting Adobe Acrobat and Adobe Acrobat Reader on Windows and macOS. The flaw allows an attacker with high privileges to escalate access when a victim opens a malicious file. Exploitation requires user interaction and depends on environmental conditions outside the attacker's direct control. Adobe published fixes in security advisory APSB26-141.
Critical Impact
A local attacker with existing privileges can leverage an untrusted search path in Adobe Acrobat to load attacker-controlled resources, resulting in privilege escalation on the affected host.
Affected Products
- Adobe Acrobat (Classic track)
- Adobe Acrobat DC and Adobe Acrobat Reader DC (Continuous track)
- Microsoft Windows and Apple macOS installations of the above products
Discovery Timeline
- 2026-09-08 - CVE-2026-80159 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-80159
Vulnerability Analysis
The issue is classified as an Untrusted Search Path weakness [CWE-426]. Adobe Acrobat resolves one or more dependencies, such as libraries or auxiliary files, using a search path that includes locations writable by lower-privileged users. When Acrobat processes a specially crafted document, it can load attacker-supplied resources from those locations instead of the intended trusted paths.
Because Acrobat processes may execute with elevated context during specific operations, loading an attacker-controlled resource results in code running with higher privileges than the attacker natively holds. The vulnerability is local in nature and requires the victim to open a malicious file. Adobe describes exploitation as conditional, meaning success depends on the target's installation layout and file system permissions.
Root Cause
The root cause is Acrobat's use of an insufficiently restricted search order when locating dependent modules or configuration files. Directories that non-privileged users can write to are consulted before, or in place of, hardened system locations. An attacker who can stage a payload in such a directory can influence which resource Acrobat loads at runtime.
Attack Vector
Exploitation is local and requires user interaction. The attacker plants a malicious library or resource in a directory reachable through Acrobat's search path, then delivers a crafted PDF or companion file to the victim. When the victim opens the file, Acrobat resolves the dependency to the attacker-controlled artifact and executes its code in Acrobat's process context, yielding elevated access.
No public proof-of-concept exploit is available for CVE-2026-80159, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe Acrobat Security Advisory APSB26-141 for vendor technical detail.
Detection Methods for CVE-2026-80159
Indicators of Compromise
- Unexpected DLL, dylib, or configuration files appearing in directories that Acrobat searches during startup or document rendering.
- Acrobat processes (Acrobat.exe, AcroRd32.exe, AdobeAcrobat) loading modules from user-writable paths such as %TEMP%, %APPDATA%, or a user's Downloads folder.
- Child processes spawned by Acrobat that perform reconnaissance, credential access, or persistence actions after a PDF is opened.
Detection Strategies
- Monitor image and module load events for Acrobat processes and alert when the loaded path resides outside Program Files, Program Files (x86), or the standard macOS application bundle.
- Correlate PDF open events with subsequent process creation to surface anomalous execution chains initiated by Acrobat.
- Hunt for file writes of .dll, .dylib, or configuration files into directories that Acrobat enumerates before opening user-supplied documents.
Monitoring Recommendations
- Enable module-load telemetry on endpoints running Adobe Acrobat and forward events to a centralized analytics platform for retrospective search.
- Baseline the normal set of libraries loaded by Acrobat processes across the fleet and alert on deviations.
- Track privileged operations performed by Acrobat processes, including registry writes, service creation, and access to sensitive files.
How to Mitigate CVE-2026-80159
Immediate Actions Required
- Apply the updates listed in Adobe security advisory APSB26-141 to all installations of Acrobat, Acrobat DC, and Acrobat Reader DC on Windows and macOS.
- Inventory endpoints for outdated Acrobat versions and prioritize systems used by administrators or users with elevated privileges.
- Restrict write permissions on any custom directories referenced by Acrobat plug-in or add-on configurations.
Patch Information
Adobe released fixed builds in the Adobe Acrobat Security Advisory APSB26-141. Update both the Classic and Continuous tracks to the versions specified in that advisory. Verify version numbers after deployment to confirm remediation.
Workarounds
- Block opening of PDFs from untrusted sources and enforce Protected View or Protected Mode where supported.
- Remove write permissions for standard users on any directory that Acrobat enumerates for plug-ins, resources, or auxiliary libraries.
- Enforce application allowlisting so that only libraries from trusted, signed publishers can load into Acrobat processes.
# Windows: verify the installed Acrobat version against APSB26-141 fixed builds
reg query "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v "VersionMax"
# macOS: check the installed Acrobat build
defaults read "/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/Info.plist" CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
