CVE-2026-81976: Adobe Acrobat Use After Free Vulnerability

CVE-2026-81976 Overview

CVE-2026-81976 is a use-after-free vulnerability [CWE-416] in Adobe Acrobat and Acrobat Reader. An attacker who convinces a victim to open a crafted PDF file can execute arbitrary code in the context of the current user. The flaw affects both the Classic and Continuous tracks of Adobe Acrobat and Acrobat Reader DC on Windows and macOS. Adobe published fixes in security bulletin APSB26-141.

Critical Impact
A single malicious PDF opened by a user can lead to arbitrary code execution with the privileges of the logged-in account, enabling malware installation, data theft, and follow-on lateral movement.

Affected Products

Adobe Acrobat (Classic track) on Windows and macOS
Adobe Acrobat DC and Acrobat Reader DC (Continuous track) on Windows and macOS
Microsoft Windows and Apple macOS hosts running the affected Acrobat/Reader builds

Discovery Timeline

2026-09-08 - CVE-2026-81976 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-81976

Vulnerability Analysis

The issue is a use-after-free in Adobe Acrobat and Acrobat Reader's PDF processing pipeline. The application frees a heap object while another code path retains and later dereferences a pointer to that object. Attackers who control the allocation and reuse of the freed memory can steer execution into attacker-supplied data.

Exploitation requires local user interaction. The victim must open a malicious PDF using a vulnerable Acrobat or Reader build. Once triggered, the resulting code runs with the same privileges as the user opening the document, so any browsing, file access, or credential material available to that account becomes reachable by the attacker.

EPSS currently rates the probability of exploitation in the near term as low, but use-after-free bugs in Acrobat have historically been weaponized in targeted phishing campaigns. No public proof-of-concept, exploit module, or CISA KEV entry is associated with this CVE at publication time.

Root Cause

The root cause is improper lifetime management of a heap-allocated object inside Acrobat's PDF parsing or rendering logic. A reference to the object survives the free operation, and the subsequent access dereferences a dangling pointer. Adobe has not published the specific object type or code path.

Attack Vector

Delivery is document-based. An attacker distributes a crafted PDF through email, chat, a compromised website, or a shared drive. When the user opens the file in a vulnerable version of Acrobat or Reader, the embedded content triggers the use-after-free and hijacks execution. Refer to the Adobe Security Patch APSB26-141 advisory for the affected build ranges.

No verified proof-of-concept code has been published for this vulnerability. Consult the vendor advisory for technical scope.

Detection Methods for CVE-2026-81976

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe, AcroRd32.exe, or AdobeAcrobat on macOS, particularly shells, scripting hosts, or rundll32.exe.
PDF files delivered by email or download that immediately precede crash events or anomalous process launches on the endpoint.
Outbound network connections initiated by the Acrobat or Reader process to previously unseen domains or IP addresses.
Creation of executables, DLLs, or scripts in user-writable directories such as %APPDATA% or ~/Library/Application Support/ shortly after opening a PDF.

Detection Strategies

Hunt for process-tree anomalies where Acrobat or Reader is the parent of interpreters (powershell.exe, cmd.exe, wscript.exe, bash, osascript).
Alert on Acrobat/Reader crashes (Windows Error Reporting or macOS ReportCrash) correlated with recent PDF opens, which can indicate exploitation attempts.
Inspect mail gateway and web proxy telemetry for PDFs containing embedded JavaScript, unusual object streams, or heavy heap-spray patterns.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake to enable retroactive hunts after new indicators emerge.
Track Acrobat and Reader version inventory across the fleet and flag hosts still running builds prior to those listed in APSB26-141.
Monitor for phishing campaigns delivering PDF attachments and correlate delivery events with endpoint execution telemetry.

How to Mitigate CVE-2026-81976

Immediate Actions Required

Apply the Adobe updates referenced in Adobe Security Bulletin APSB26-141 to all Windows and macOS endpoints running Acrobat or Reader.
Prioritize patching of high-risk user populations that frequently open external PDFs, including executives, finance, HR, and legal teams.
Verify patch deployment by querying installed Acrobat and Reader versions across the estate and remediating any hosts that report vulnerable builds.

Patch Information

Adobe released fixed builds for Acrobat Classic, Acrobat DC Continuous, and Acrobat Reader DC Continuous in bulletin APSB26-141. Administrators should deploy the updated installers through Adobe Admin Console, Microsoft Intune, SCCM, Jamf, or equivalent management tooling and confirm the resulting version matches or exceeds the vendor-listed patched build.

Workarounds

Enable Protected View and Protected Mode in Acrobat and Reader to sandbox PDF rendering until patches are applied.
Block or quarantine inbound PDF attachments from untrusted senders at the email gateway, and strip active content such as embedded JavaScript.
Disable JavaScript execution inside Acrobat and Reader via enterprise policy for user populations that do not require it.
Restrict local administrator rights so that any successful exploitation runs with reduced privileges.

bash

# Windows: disable Acrobat JavaScript enterprise-wide via registry
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f

# Confirm Protected Mode is enabled for Reader DC
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bProtectedMode /t REG_DWORD /d 1 /f