CVE-2026-81980: Adobe Acrobat RCE Vulnerability

CVE-2026-81980 Overview

CVE-2026-81980 is an out-of-bounds write vulnerability [CWE-787] in Adobe Acrobat and Acrobat Reader. Successful exploitation lets an attacker execute arbitrary code in the context of the current user. The flaw affects Acrobat Classic, Acrobat DC Continuous, and Acrobat Reader DC Continuous on both Microsoft Windows and Apple macOS. Exploitation requires user interaction: a victim must open a malicious PDF file crafted by the attacker. Adobe published the fix in security advisory APSB26-141. No public proof-of-concept exploit and no confirmed in-the-wild exploitation have been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
An attacker who convinces a user to open a malicious PDF can achieve arbitrary code execution with the privileges of the current user, enabling malware installation, data theft, or lateral movement.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Microsoft Windows and Apple macOS installations of the above clients

Discovery Timeline

2026-09-08 - CVE-2026-81980 published to the National Vulnerability Database
2026-09-10 - Record last modified in NVD

Technical Details for CVE-2026-81980

Vulnerability Analysis

The issue is an out-of-bounds write in Adobe Acrobat and Reader's PDF parsing pipeline. When the application processes a crafted PDF, it writes data past the boundary of an allocated buffer. This memory corruption can overwrite adjacent structures such as function pointers, virtual tables, or heap metadata. An attacker who controls the overwritten data can redirect execution flow and run arbitrary code within the rendering process. Because Acrobat and Reader run with the current user's privileges, the resulting code execution inherits that user's access to files, credentials, and network resources. Adobe classifies the issue as high severity and addresses it in APSB26-141. The attack requires local file handling and user interaction, which limits mass exploitation but fits well-established phishing and social-engineering delivery chains.

Root Cause

The root cause is improper bounds validation during processing of attacker-controlled PDF content [CWE-787]. Adobe has not published the specific object type or parser component involved. Out-of-bounds writes in PDF readers typically originate in image decoders, font handlers, JavaScript engines, or embedded object parsers where length fields from the file are trusted without validation.

Attack Vector

Delivery is local: the victim must open the malicious PDF. Attackers commonly deliver such files through phishing email attachments, malicious download links, or drive-by download pages. Once the file is opened, exploitation runs in the Acrobat or Reader process without any further user action. The resulting code executes with the privileges of the logged-on user.

No verified public exploit code is available for CVE-2026-81980. See the Adobe Acrobat Security Advisory APSB26-141 for vendor-provided technical details.

Detection Methods for CVE-2026-81980

Indicators of Compromise

PDF files arriving from untrusted senders that contain unusual embedded objects, malformed streams, or heavily obfuscated JavaScript.
Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe on Windows, or by Acrobat processes on macOS.
Outbound network connections initiated by Acrobat or Reader to unknown domains shortly after a PDF is opened.

Detection Strategies

Hunt for Acrobat or Reader processes writing executables, scripts, or scheduled task artifacts to disk.
Alert on Acrobat launching command interpreters such as cmd.exe, powershell.exe, wscript.exe, or /bin/sh.
Correlate PDF open events with subsequent LOLBin execution, credential access attempts, or persistence changes.

Monitoring Recommendations

Track installed Acrobat and Reader versions against the fixed releases listed in APSB26-141 across the fleet.
Ingest endpoint process telemetry, email gateway attachment logs, and web proxy download logs into a central analytics platform for cross-source correlation.
Monitor crash reports from Acrobat and Reader, since exploitation attempts often generate access-violation exceptions before achieving stable code execution.

How to Mitigate CVE-2026-81980

Immediate Actions Required

Apply the Adobe updates referenced in APSB26-141 to all Acrobat, Acrobat DC, and Acrobat Reader DC installations on Windows and macOS.
Prioritize patching for users who routinely handle external PDFs, such as legal, finance, HR, and executive staff.
Reinforce phishing awareness and instruct users not to open unexpected PDF attachments, even from known contacts.

Patch Information

Adobe released fixed builds for the Classic and Continuous tracks of Acrobat and Reader. Refer to the Adobe Acrobat Security Advisory APSB26-141 for exact fixed version numbers and download locations. Enable automatic updates where operationally supported to reduce patch latency.

Workarounds

Enable Protected View and Protected Mode (sandbox) in Acrobat and Reader to constrain the impact of a successful exploit.
Block or strip PDF attachments at the email gateway when the sender or content fails reputation and content inspection checks.
Use application control to restrict Acrobat and Reader from spawning shells, script interpreters, or unsigned executables.
Consider server-side PDF rendering or a browser-based PDF viewer for high-risk workflows until patching is complete.

bash

# Example: enforce Protected Mode for Adobe Reader DC on Windows via registry
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bProtectedMode /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f