CVE-2026-80162: Adobe Acrobat Use After Free Vulnerability

CVE-2026-80162 Overview

CVE-2026-80162 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. Successful exploitation allows an attacker to disclose sensitive process memory. Exploitation requires user interaction: a victim must open a crafted PDF file. The flaw exposes memory contents that may include pointers, cryptographic material, or fragments of prior document data, which an attacker can leverage to bypass mitigations such as Address Space Layout Randomization (ASLR).

Critical Impact
Attackers can disclose sensitive memory from the Acrobat process when a victim opens a malicious PDF, enabling further exploitation chains.

Affected Products

Adobe Acrobat (classic track)
Adobe Acrobat DC and Acrobat Reader DC (continuous track)
Microsoft Windows and Apple macOS host platforms

Discovery Timeline

2026-09-08 - CVE-2026-80162 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80162

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] within Adobe Acrobat's PDF parsing and rendering pipeline. Acrobat frees a heap object while still retaining a reference to it. Subsequent access to the dangling pointer reads memory that has been reallocated with attacker-influenced content or leftover process data. The read primitive leaks information rather than corrupts control flow, which aligns with the confidentiality-only impact profile of this issue.

An attacker delivers a crafted PDF and induces the victim to open it. Because the attack vector is local and requires user interaction, delivery typically occurs through phishing, drive-by download, or messaging platforms. No elevated privileges are required on the target system.

Root Cause

The root cause is improper object lifetime management in the Acrobat rendering or scripting engine. Code paths release a heap allocation but do not clear or invalidate references held elsewhere in the object graph. When the freed slot is reused, the stale pointer resolves to memory owned by a different structure, returning its contents to attacker-controlled logic embedded in the PDF.

Attack Vector

Exploitation follows a standard client-side pattern. The attacker constructs a PDF that triggers the specific parsing or object-manipulation sequence causing the premature free. Embedded JavaScript, form actions, or object streams within the PDF then read from the dangling reference and exfiltrate the leaked bytes through document behavior observable to the attacker. No verified public proof-of-concept code is available for CVE-2026-80162 at this time. Refer to the Adobe Security Advisory APSB26-141 for vendor technical guidance.

Detection Methods for CVE-2026-80162

Indicators of Compromise

Unexpected Acrobat or Acrobat Reader processes spawning child processes such as cmd.exe, powershell.exe, or scripting hosts shortly after opening a PDF
PDF files arriving through email, chat, or web downloads that contain embedded JavaScript, unusual object streams, or malformed cross-reference tables
Acrobat process crashes or memory access violations logged in Windows Event Log or macOS unified logs correlated with PDF open events

Detection Strategies

Deploy behavioral endpoint detection to flag anomalous memory-read patterns and process behavior originating from AcroRd32.exe or Acrobat.exe
Inspect inbound PDFs at the mail gateway and web proxy for embedded JavaScript, suspicious action dictionaries, and known Use After Free trigger structures
Correlate document open telemetry with subsequent outbound network connections that may indicate exfiltration of leaked memory contents

Monitoring Recommendations

Track Adobe Acrobat versions across the fleet and alert on hosts running builds prior to those listed in APSB26-141
Log and review PDF open events, particularly from external senders or newly observed domains
Monitor for repeated Acrobat crash events, which can indicate exploitation attempts or reconnaissance for Use After Free triggers

How to Mitigate CVE-2026-80162

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-141 to all affected Acrobat and Acrobat Reader installations on Windows and macOS
Prioritize patching for users who routinely handle externally sourced PDFs, including finance, legal, and executive assistants
Enable Acrobat's Protected View and Protected Mode (sandbox) to constrain the impact of a successful exploit

Patch Information

Adobe released fixes for the affected classic and continuous tracks of Acrobat and Acrobat Reader. Consult the Adobe Security Advisory APSB26-141 for the specific patched build numbers for each product track and platform. Apply updates through Adobe's built-in updater, enterprise deployment tooling, or Microsoft Endpoint Configuration Manager.

Workarounds

Disable JavaScript execution in Acrobat via Edit > Preferences > JavaScript to reduce the attack surface for PDF-borne exploitation
Configure the Windows registry or macOS configuration profiles to force Protected View for files from untrusted sources
Block or quarantine PDFs from unknown external senders at the email gateway until patches are deployed

bash

# Windows registry example: force Protected View for files from unsafe locations
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f

# Disable JavaScript in Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f