CVE-2026-80161: Adobe Acrobat Type Confusion RCE Vulnerability

CVE-2026-80161 Overview

CVE-2026-80161 is a type confusion vulnerability [CWE-843] in Adobe Acrobat and Acrobat Reader. The flaw allows an attacker to execute arbitrary code in the context of the current user when a victim opens a crafted PDF file. Exploitation requires user interaction, which limits mass exploitation but remains effective against targeted phishing and social engineering campaigns.

Adobe published the fix in security bulletin APSB26-141. The vulnerability affects Acrobat DC, Acrobat Reader DC, and Acrobat Classic on both Microsoft Windows and Apple macOS.

Critical Impact
A malicious PDF opened by a user grants the attacker code execution rights equivalent to that user, enabling credential theft, malware deployment, and lateral movement.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Adobe Acrobat and Reader on Microsoft Windows and Apple macOS

Discovery Timeline

2026-09-08 - CVE-2026-80161 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80161

Vulnerability Analysis

CVE-2026-80161 is a type confusion weakness in Adobe Acrobat's PDF parsing and rendering logic. Type confusion occurs when code accesses a resource using an incompatible type, causing the process to interpret memory as an object it is not. Attackers weaponize this mismatch to corrupt object metadata, control virtual function pointers, or redirect execution to attacker-supplied code.

Because Acrobat handles JavaScript, embedded fonts, forms, and rich media inside PDF documents, the parser exposes a large attack surface. A crafted document can steer object handling down a path where a type assumption is violated, leading to controlled memory access and, ultimately, arbitrary code execution in the user's session.

Root Cause

The underlying defect is classified under [CWE-843]: Access of Resource Using Incompatible Type. Adobe's advisory does not disclose the specific object handler at fault, but this class of bug generally stems from missing runtime type checks after cast operations or from object reuse across incompatible schemas during PDF stream parsing.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious PDF through email attachments, drive-by downloads, or file-sharing platforms. When the victim opens the file in a vulnerable Acrobat build, the exploit triggers during document rendering. Successful exploitation yields code execution with the privileges of the logged-in user, which is sufficient to install persistence, exfiltrate data, or stage follow-on payloads.

No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities listing has been published as of the last NVD update. The EPSS probability remains low, reflecting limited observed exploitation activity.

Detection Methods for CVE-2026-80161

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Adobe Acrobat processes making outbound network connections to unfamiliar domains shortly after a PDF is opened.
Creation of executable files, scripts, or scheduled tasks in user-writable directories following PDF interaction.
Crash events or Windows Error Reporting entries referencing Acrobat modules and access-violation exceptions.

Detection Strategies

Deploy behavioral endpoint detection rules that flag Acrobat processes launching interpreters, shells, or LOLBins.
Enable Microsoft Office and PDF reader attack surface reduction rules to block child process creation from document readers.
Hunt for suspicious .pdf attachments with embedded JavaScript, unusual object streams, or malformed cross-reference tables via mail gateway inspection.

Monitoring Recommendations

Centralize Acrobat process and file telemetry in a SIEM to correlate document opens with subsequent process, file, and network activity.
Track Adobe Acrobat version inventory across the fleet and alert on hosts running builds prior to those listed in APSB26-141.
Monitor user reports of Acrobat crashes, which can indicate failed exploitation attempts against unpatched hosts.

How to Mitigate CVE-2026-80161

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-141 to all Acrobat and Acrobat Reader installations on Windows and macOS.
Prioritize patching for users who routinely handle external PDF documents, including finance, legal, HR, and executive assistants.
Enable automatic updates in Acrobat so future advisories are remediated without manual intervention.

Patch Information

Adobe addressed CVE-2026-80161 in the updates listed in bulletin APSB26-141. The bulletin covers both the Continuous track (Acrobat DC, Acrobat Reader DC) and the Classic track. Administrators should validate that endpoints reflect the fixed build numbers after deployment.

Workarounds

Enable Protected View and Protected Mode in Acrobat to sandbox document rendering and constrain exploit impact.
Disable JavaScript in Acrobat via Preferences > JavaScript > Enable Acrobat JavaScript where business workflows permit.
Route inbound PDFs through a content disarm and reconstruction (CDR) gateway to strip active content before delivery.
Restrict Acrobat file-open associations for untrusted sources by opening unknown PDFs in a browser-based renderer or isolated environment.

bash

# Configuration example: disable Acrobat JavaScript via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f