CVE-2026-81982: Adobe Acrobat Information Disclosure Flaw

CVE-2026-81982 Overview

CVE-2026-81982 is an out-of-bounds read vulnerability [CWE-125] in Adobe Acrobat and Acrobat Reader. The flaw allows disclosure of sensitive process memory when a user opens a crafted file. Adobe published the fix in security bulletin APSB26-141.

Exploitation requires local user interaction, specifically opening a malicious document. Successful exploitation can leak memory contents that may include pointers, secrets, or fragments useful for defeating address space layout randomization (ASLR) and chaining further attacks.

Critical Impact
An attacker who convinces a victim to open a malicious PDF can read out-of-bounds memory from the Acrobat process, exposing sensitive data and potentially weakening exploit mitigations for follow-on attacks.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Adobe Acrobat on Apple macOS and Microsoft Windows

Discovery Timeline

2026-09-08 - CVE-2026-81982 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81982

Vulnerability Analysis

The issue is an out-of-bounds read within Adobe Acrobat and Acrobat Reader parsers. When the application processes a malformed PDF structure, it reads memory beyond the intended buffer boundary. The out-of-bounds data is then handled by downstream logic that can expose it to the attacker through document rendering or scripting responses.

Because the vulnerability is a read primitive rather than a write, it does not directly yield code execution. However, leaked memory can include heap pointers, module base addresses, or cryptographic material. Attackers commonly pair such reads with a separate memory corruption bug to bypass ASLR and achieve reliable exploitation.

The attack vector is Local and requires user interaction. Confidentiality impact is High, while integrity and availability are unaffected, matching the classic profile of an information-disclosure primitive.

Root Cause

The root cause is missing or incorrect bounds validation when the parser reads a length or offset field from an attacker-controlled PDF object. The parser trusts the value and dereferences memory outside the allocated buffer. This aligns with CWE-125: Out-of-bounds Read.

Attack Vector

An attacker crafts a malicious PDF that triggers the vulnerable parsing path. The attacker delivers the file through email, a web download, a shared drive, or a phishing lure. When the victim opens the file in a vulnerable Acrobat or Reader build, the process reads memory outside the intended buffer and returns fragments of that memory to attacker-controlled logic within the document.

No verified public proof-of-concept is available at the time of publication. See the Adobe Acrobat Security Advisory for vendor technical details.

Detection Methods for CVE-2026-81982

Indicators of Compromise

PDF files with malformed object streams, unusual /Length values, or crafted embedded fonts and images that trigger parsing anomalies in Acrobat or Reader.
Acrobat or Reader process crashes, unexpected exits, or Windows Error Reporting entries referencing AcroRd32.exe or Acrobat.exe shortly after opening a document.
Outbound network connections initiated by the Acrobat process immediately after a document open event, particularly to uncategorized or newly registered domains.

Detection Strategies

Hunt for Acrobat or Reader child processes spawning scripting engines, command shells, or LOLBins immediately following a document open event.
Correlate email or web download telemetry with Acrobat process anomalies to identify inbound delivery of suspicious PDFs.
Inspect PDFs at the mail gateway or proxy for structural anomalies and JavaScript that references document internals in ways consistent with memory-probing behavior.

Monitoring Recommendations

Monitor endpoint EDR telemetry for Acrobat process crashes and access violations, which are early signals of exploitation attempts.
Track installed Acrobat and Reader versions across the fleet and alert on hosts running builds prior to the APSB26-141 fix.
Log and review file-open events for PDFs originating from external sources, especially those delivered via consumer email or messaging platforms.

How to Mitigate CVE-2026-81982

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-141 to all Windows and macOS endpoints running Acrobat or Reader.
Prioritize patching for users who routinely handle PDFs from external sources, including finance, legal, HR, and executive assistants.
Remind users to avoid opening unexpected PDF attachments and to report suspicious documents to the security team.

Patch Information

Adobe has released fixed builds for Acrobat Classic, Acrobat DC (Continuous), and Acrobat Reader DC (Continuous) on both Windows and macOS. Refer to the Adobe Acrobat Security Advisory for exact build numbers and download links. Deploy through Adobe Admin Console, SCCM, Intune, Jamf, or equivalent enterprise software distribution tooling.

Workarounds

Enable Protected View for all files originating from the internet and other untrusted locations to sandbox parsing operations.
Disable JavaScript execution in Acrobat and Reader through preferences or Group Policy to reduce the attack surface exposed to malicious documents.
Route inbound PDFs through a mail gateway that performs content disarm and reconstruction (CDR) or sandbox detonation before delivery to end users.

bash

# Windows Group Policy registry keys to enforce Protected View and disable JavaScript
# Enforce Protected View for files from untrusted sources (2 = all files)
reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f

# Disable Acrobat JavaScript
reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f

# Enable Enhanced Security
reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bEnhancedSecurityStandalone /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bEnhancedSecurityInBrowser /t REG_DWORD /d 1 /f