CVE-2026-80160 Overview
CVE-2026-80160 is an out-of-bounds read vulnerability [CWE-125] affecting Adobe Acrobat and Adobe Acrobat Reader on Windows and macOS. The flaw allows an attacker to read memory outside allocated buffer boundaries, leading to disclosure of sensitive process memory. Exploitation requires user interaction: a victim must open a specially crafted PDF file. The vulnerability does not affect data integrity or system availability but can leak sensitive information such as memory addresses, tokens, or fragments of data resident in the Acrobat process. Adobe published fixes in security bulletin APSB26-141.
Critical Impact
Successful exploitation discloses sensitive memory contents from the Acrobat process, which attackers can use to defeat mitigations like ASLR or extract residual application data.
Affected Products
- Adobe Acrobat (Classic track)
- Adobe Acrobat DC and Adobe Acrobat Reader DC (Continuous track)
- Adobe Acrobat on Apple macOS and Microsoft Windows
Discovery Timeline
- 2026-09-08 - CVE-2026-80160 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-80160
Vulnerability Analysis
CVE-2026-80160 is classified as an Out-of-Bounds Read [CWE-125] within Adobe Acrobat and Acrobat Reader. The vulnerable code path reads beyond the boundary of an allocated buffer while parsing attacker-controlled PDF content. Instead of returning a validation error, the parser returns adjacent process memory to the caller, which the application then processes, renders, or exposes. Because the attack vector is local and requires user interaction, exploitation typically occurs through phishing lures containing malicious .pdf attachments or drive-by downloads. The impact is confined to confidentiality: no code execution, memory corruption, or denial of service is expected from this issue alone. However, disclosed memory can be chained with separate vulnerabilities to bypass ASLR and enable reliable exploitation of memory-corruption bugs.
Root Cause
The root cause is missing or incorrect bounds validation during parsing of a PDF object or stream. When the parser calculates an offset or length from attacker-controlled metadata, the resulting read extends past the end of the intended buffer. Adobe's advisory APSB26-141 addresses the flaw by tightening validation of these length and offset fields.
Attack Vector
An attacker crafts a malicious PDF and delivers it via email, chat, or a web link. When the victim opens the file in a vulnerable version of Acrobat or Reader, the parser triggers the out-of-bounds read. The attacker recovers leaked memory through embedded scripting, form fields, or rendered output channels within the document.
No verified public proof-of-concept code is available for CVE-2026-80160. Refer to the Adobe Acrobat Security Bulletin APSB26-141 for vendor technical detail.
Detection Methods for CVE-2026-80160
Indicators of Compromise
- Unexpected PDF files delivered via email or messaging platforms containing malformed object streams, cross-reference tables, or embedded JavaScript.
- Acrobat or Reader processes making unusual outbound network connections shortly after opening a document.
- Crash or exception logs from Acrobat.exe or AcroRd32.exe referencing access-violation reads during PDF parsing.
Detection Strategies
- Inspect inbound PDF attachments at the mail gateway using content-disarm-and-reconstruction or sandbox detonation to identify anomalous object structures.
- Monitor endpoint telemetry for Acrobat processes spawning child processes, accessing unrelated user data, or initiating network requests after opening a document.
- Correlate document-open events with subsequent DNS queries or HTTP POSTs from Acrobat to catch memory-exfiltration attempts.
Monitoring Recommendations
- Enable process, file, and network telemetry on endpoints running Acrobat and forward it to a centralized analytics platform for retrospective hunting.
- Alert on Acrobat versions below the fixed builds listed in APSB26-141 observed in software inventory data.
- Track user-reported document rendering errors that may indicate exploitation attempts against unpatched clients.
How to Mitigate CVE-2026-80160
Immediate Actions Required
- Apply the Adobe Acrobat and Acrobat Reader updates referenced in security bulletin APSB26-141 on all Windows and macOS endpoints.
- Inventory installed Acrobat versions across the estate and prioritize systems with high user exposure to external PDF content.
- Restrict execution of JavaScript inside PDFs where business use cases allow it to be disabled.
Patch Information
Adobe released fixed builds for both the Classic and Continuous tracks of Acrobat and Acrobat Reader. See the Adobe Acrobat Security Bulletin APSB26-141 for the specific versions and download locations. Deploy the updates through the Adobe Admin Console, Microsoft Intune, Jamf, or standard patch-management tooling.
Workarounds
- Configure Acrobat's Protected View and Protected Mode to isolate untrusted PDFs from sensitive host resources.
- Block PDF attachments from external senders at the mail gateway until endpoints are patched.
- Route untrusted PDFs through a server-side rendering or sandbox service so end users never open the raw file locally.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
