CVE-2026-81984 Overview
Adobe Acrobat Reader contains a Use After Free vulnerability [CWE-416] that can disclose sensitive memory contents to an attacker. The flaw affects Adobe Acrobat, Acrobat DC, and Acrobat Reader DC on both Microsoft Windows and Apple macOS platforms. Exploitation requires user interaction: a victim must open a crafted PDF file for the attack to succeed. Successful exploitation reveals memory content that may include sensitive process data, weakening address space layout randomization (ASLR) or exposing secrets held by the application.
Critical Impact
An attacker who convinces a user to open a malicious PDF can read sensitive process memory from Adobe Acrobat Reader, potentially exposing confidential data and aiding chained exploitation.
Affected Products
- Adobe Acrobat (Classic track)
- Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
- Adobe Acrobat and Reader on Microsoft Windows and Apple macOS
Discovery Timeline
- 2026-09-08 - CVE-2026-81984 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-81984
Vulnerability Analysis
The vulnerability is a Use After Free condition in Adobe Acrobat and Acrobat Reader. Use After Free issues occur when a program continues to reference a memory region after that region has been released back to the allocator. When Acrobat later reads the dangling pointer, it can return memory that has been reallocated to unrelated data structures. An attacker crafts a PDF that triggers the specific object lifecycle path, then reads the returned bytes through the document context. The result is disclosure of sensitive process memory rather than code execution, matching the confidentiality-only impact profile of this flaw.
Root Cause
The root cause is improper object lifetime management within Acrobat's PDF processing code. A component frees an internal object while another code path retains a reference to it. Subsequent access reads whatever data the allocator has since placed at that address. This class of bug is tracked as [CWE-416] Use After Free.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a malicious PDF through email, a web download, or file share. When the victim opens the document in a vulnerable version of Acrobat or Reader, the crafted content triggers the freed-object access. The attacker cannot execute the exploit remotely without user action, and no privileges are required on the target host beyond the ability to run Acrobat.
No public proof-of-concept or exploit code has been observed at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
No verified proof-of-concept code is publicly available.
Refer to the Adobe advisory APSB26-141 for technical details.
Detection Methods for CVE-2026-81984
Indicators of Compromise
- PDF files delivered through email or web downloads that trigger unexpected Acrobat or Reader crashes referencing access violations in PDF parsing modules.
- Acrobat or Reader processes generating Windows Error Reporting or macOS crash reports with heap-corruption signatures shortly after opening a document.
- Outbound network connections initiated by AcroRd32.exe or Acrobat.exe immediately after a document open event.
Detection Strategies
- Inventory endpoints running Adobe Acrobat and Reader and identify hosts on versions prior to the APSB26-141 fix.
- Alert on PDF files opened from untrusted locations such as temporary browser directories, email attachment caches, and removable media.
- Correlate PDF open events with subsequent child-process creation from AcroRd32.exe or Acrobat.exe, which is atypical for pure information-disclosure exploitation but common in chained attacks.
Monitoring Recommendations
- Forward Acrobat process telemetry, file open events, and crash logs to a centralized analytics platform for retrospective hunting.
- Monitor mail gateways and web proxies for PDF attachments with anomalous JavaScript, embedded fonts, or malformed object streams.
- Track patch compliance for Adobe Acrobat and Reader as a measurable control and alert on drift beyond a defined SLA.
How to Mitigate CVE-2026-81984
Immediate Actions Required
- Apply the Adobe security update referenced in Adobe Security Bulletin APSB26-141 to all Windows and macOS endpoints running Acrobat or Reader.
- Prioritize patching for users who routinely process external PDF content such as legal, finance, and executive assistants.
- Educate users to avoid opening unsolicited PDF attachments and to report suspicious documents to the security team.
Patch Information
Adobe has released fixed versions for Acrobat and Acrobat Reader in both the Classic and Continuous update tracks. Deployment guidance and version details are published in Adobe Security Bulletin APSB26-141. Enterprises should use their standard software distribution tooling to deliver the update and verify installation through inventory reporting.
Workarounds
- Enable Protected View in Acrobat and Reader to open documents from the Internet and unsafe locations in a restricted sandbox.
- Restrict PDF handling to a hardened alternative viewer on high-risk hosts until the patch is deployed.
- Block or quarantine inbound PDF attachments at the mail gateway when they originate from untrusted senders or contain active content.
# Windows: query installed Adobe Acrobat/Reader versions to validate patch state
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Adobe Acrobat" /s /v "Version"
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader" /s /v "Version"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
