CVE-2026-81973: Adobe Acrobat Use After Free Vulnerability

CVE-2026-81973 Overview

CVE-2026-81973 is a use-after-free vulnerability [CWE-416] in Adobe Acrobat and Adobe Acrobat Reader. An attacker can achieve arbitrary code execution in the context of the current user by convincing a victim to open a crafted PDF file. The flaw affects Adobe Acrobat DC and Acrobat Reader DC on both Microsoft Windows and Apple macOS. Adobe published the fix in security bulletin APSB26-141.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user opening the malicious PDF, providing an initial access foothold on the endpoint.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Adobe Acrobat and Reader on Microsoft Windows and Apple macOS

Discovery Timeline

2026-09-08 - CVE-2026-81973 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81973

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] inside the Adobe Acrobat and Reader PDF parsing and rendering engine. When a specially crafted PDF triggers the flaw, the application references memory that has already been released. An attacker who controls the freed allocation can steer execution flow and run arbitrary code in the process context.

Because Acrobat runs with the privileges of the interactive user, the resulting code execution inherits that user's file, network, and identity access. On managed endpoints, this is a common initial-access primitive used to stage follow-on tooling, persistence, or credential theft.

Root Cause

Use-after-free bugs in document readers typically stem from mishandled object lifetimes during parsing of complex embedded content such as JavaScript, forms, annotations, or images. A dangling pointer survives beyond the referenced object's lifetime, and later access dereferences attacker-influenced memory. Adobe has not published a technical root-cause writeup beyond bulletin APSB26-141.

Attack Vector

Exploitation requires local file handling with user interaction. The victim must open a malicious PDF delivered through email, chat, a browser download, or a shared drive. No elevated privileges or prior authentication are needed on the target system. Attackers commonly pair this class of bug with a sandbox escape or living-off-the-land tooling to expand impact after initial code execution.

No public proof-of-concept or in-the-wild exploitation has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Detection Methods for CVE-2026-81973

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe on Windows, or AdobeAcrobat on macOS, such as cmd.exe, powershell.exe, wscript.exe, or shell interpreters.
Acrobat processes writing executables, scripts, or DLLs to user-writable paths like %APPDATA%, %TEMP%, or ~/Library/Application Support.
Outbound network connections initiated directly by Acrobat processes to previously unseen or low-reputation hosts.
Crash artifacts, Windows Error Reporting entries, or macOS diagnostic reports referencing Acrobat modules following the opening of a PDF.

Detection Strategies

Hunt for PDF-borne exploitation chains by correlating PDF file opens with process, file, and network telemetry from the Acrobat process tree.
Alert on Acrobat loading unusual modules or invoking script interpreters, which is uncommon in normal document workflows.
Baseline Acrobat versions across the fleet and flag hosts running versions below the fixed builds listed in APSB26-141.

Monitoring Recommendations

Ingest endpoint process, file, and DNS telemetry into a central analytics platform and retain PDF-handling events for retrospective hunting.
Monitor email and web gateways for inbound PDF attachments and URLs, and enrich alerts with sender reputation and sandbox verdicts.
Track Adobe patch compliance through vulnerability management scans and reconcile against the affected CPE list.

How to Mitigate CVE-2026-81973

Immediate Actions Required

Apply the Adobe security update from bulletin APSB26-141 to all Acrobat and Acrobat Reader installations on Windows and macOS.
Prioritize patching for users who routinely open PDFs from external senders, including finance, legal, HR, and executive assistants.
Verify that Protected View and Protected Mode (sandbox) are enabled by policy after patching.

Patch Information

Adobe addressed CVE-2026-81973 in the updates published in security bulletin Adobe Acrobat Security Update APSB26-141. Administrators should deploy the fixed builds for both the Continuous track (Acrobat DC, Acrobat Reader DC) and the Classic track through Adobe Update Server, SCCM, Intune, Jamf, or the built-in updater.

Workarounds

Enable Protected View for files originating from the internet and from unsafe locations across the enterprise.
Block or quarantine inbound PDFs from untrusted senders at the email gateway, and detonate suspicious attachments in a sandbox before delivery.
Restrict local administrator rights so that any code execution occurring under Acrobat inherits reduced privileges.
Where feasible, force PDFs to render in the browser's built-in viewer until patching is complete.

bash

# Windows: verify installed Acrobat/Reader versions across endpoints
Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -match 'Adobe Acrobat' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

# Windows: enforce Protected View for files from the internet (per-user policy)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bProtectedMode /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f