CVE-2026-81975: Adobe Acrobat Use After Free Vulnerability

CVE-2026-81975 Overview

CVE-2026-81975 is a use-after-free vulnerability [CWE-416] affecting Adobe Acrobat and Adobe Acrobat Reader. Successful exploitation allows an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction: the victim must open a malicious PDF file crafted by the attacker.

The flaw affects both the Classic and Continuous tracks of Adobe Acrobat and Acrobat Reader DC on Microsoft Windows and Apple macOS. Adobe published a security advisory addressing this issue.

Critical Impact
An attacker who convinces a user to open a malicious PDF can run arbitrary code with the privileges of the current user, enabling malware installation, credential theft, or lateral movement.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Microsoft Windows and Apple macOS installations of the above

Discovery Timeline

2026-09-08 - CVE-2026-81975 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81975

Vulnerability Analysis

CVE-2026-81975 is a use-after-free condition in Adobe Acrobat and Acrobat Reader. Use-after-free flaws occur when an application continues to reference memory that has already been released back to the allocator. When an attacker controls the contents of the reallocated memory region, dereferencing the stale pointer can redirect execution to attacker-controlled data.

In the context of Acrobat, PDF parsing routines and embedded object handlers manage a complex graph of objects across JavaScript, form fields, annotations, and rendering pipelines. A malformed or specially crafted PDF can trigger the release of an internal object while another code path retains a reference to it. Subsequent operations on the freed object yield arbitrary code execution under the current user's security context.

The vulnerability is local in nature and requires user interaction, but delivery is trivial via email attachments, drive-by downloads, or shared document repositories.

Root Cause

The root cause is improper object lifetime management within Acrobat's document processing logic, classified under [CWE-416] Use After Free. Adobe's advisory APSB26-141 addresses the defect but does not disclose the specific component or function affected.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious PDF that triggers the use-after-free condition when opened in a vulnerable Acrobat or Reader installation. The exploit executes with the privileges of the user opening the document, which on typical workstations includes access to user data, network shares, and cached credentials. No verified public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-81975

Indicators of Compromise

PDF files opened from untrusted sources followed by unexpected child processes spawned from Acrobat.exe or AcroRd32.exe on Windows, or AdobeAcrobat on macOS.
Acrobat processes making outbound network connections to unfamiliar hosts shortly after opening a document.
Crash reports or Windows Error Reporting entries referencing access violations in Acrobat modules.

Detection Strategies

Monitor for anomalous process trees where Acrobat spawns interpreters such as cmd.exe, powershell.exe, wscript.exe, or shell processes on macOS.
Alert on Acrobat writing executable content to disk or to user-writable autorun locations.
Correlate PDF file delivery through email or web downloads with subsequent endpoint anomalies within a short time window.

Monitoring Recommendations

Enable process creation and file write telemetry on all endpoints running Adobe Acrobat or Reader.
Ingest email gateway and web proxy logs into a SIEM to trace the origin of suspicious PDF documents.
Review endpoint detection alerts referencing memory corruption or exploit mitigation triggers in Acrobat processes.

How to Mitigate CVE-2026-81975

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB26-141 to all Acrobat and Reader installations on Windows and macOS.
Inventory endpoints for Classic and Continuous track versions of Acrobat and prioritize patching for users who frequently handle external PDFs.
Restrict opening PDF attachments from untrusted senders through email gateway policies until patching is complete.

Patch Information

Adobe released a security patch documented in the Adobe Acrobat Security Advisory APSB26-141. Administrators should update to the fixed versions listed in the advisory for both the Classic and Continuous tracks on Windows and macOS.

Workarounds

Enable Protected View and Protected Mode in Acrobat and Reader to sandbox document processing.
Disable JavaScript execution in Acrobat via Preferences > JavaScript where business workflows permit.
Use application allowlisting to prevent Acrobat from launching child interpreters such as scripting hosts and command shells.

bash

# Windows registry example: disable JavaScript in Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for files from all sources
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f