CVE-2026-81987: Adobe Acrobat RCE Vulnerability

CVE-2026-81987 Overview

CVE-2026-81987 is an integer overflow or wraparound vulnerability [CWE-190] in Adobe Acrobat and Acrobat Reader. Successful exploitation allows arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious PDF file crafted by the attacker. The flaw affects Acrobat and Acrobat Reader on both Windows and macOS platforms. Adobe published a security bulletin (APSB26-141) addressing this issue.

Critical Impact
A crafted PDF can trigger an integer overflow in Acrobat, corrupt memory, and execute arbitrary code with the privileges of the current user.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Adobe Acrobat and Reader on Microsoft Windows and Apple macOS

Discovery Timeline

2026-09-08 - CVE-2026-81987 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-81987

Vulnerability Analysis

The issue is classified as an integer overflow or wraparound weakness [CWE-190] in Adobe Acrobat's PDF parsing and rendering logic. When Acrobat processes attacker-controlled size, offset, or count values from a malicious PDF, an arithmetic operation exceeds the storage capacity of its integer type. The wrapped value is then used to compute buffer allocations or indexing bounds. This produces undersized allocations or out-of-bounds writes during subsequent memory operations. An attacker leverages this corrupted state to hijack control flow and execute code as the user running Acrobat.

Because the vulnerability executes in the local user context, an adversary who compromises a standard user can pivot to installed software, browser sessions, and cached credentials. Chained with a local privilege escalation, the impact can extend to full host compromise.

Root Cause

The root cause is unchecked integer arithmetic on values parsed from PDF structures. Adobe's advisory APSB26-141 documents the fix but does not publicly enumerate the specific object or stream handler involved.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious PDF through phishing email, a compromised website, a shared file store, or messaging platforms. When the victim opens the file in a vulnerable Acrobat build, the integer overflow triggers during parsing and yields arbitrary code execution. No authentication or elevated privileges are required on the target system. See the Adobe Acrobat Security Update APSB26-141 for vendor-published details.

Detection Methods for CVE-2026-81987

Indicators of Compromise

Unexpected child processes spawned from AcroRd32.exe or Acrobat.exe, particularly cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
PDF files arriving from untrusted email senders or external file-sharing links that trigger Acrobat crashes on open.
New persistence entries (Run keys, scheduled tasks, LaunchAgents on macOS) created shortly after a PDF is opened.
Outbound network connections initiated by Acrobat processes to previously unseen domains or IP addresses.

Detection Strategies

Monitor process lineage where Acrobat is the parent of a shell or scripting interpreter, which is anomalous under normal document viewing.
Alert on Acrobat process crashes followed by rapid new process creation, indicating exploitation followed by shellcode execution.
Inspect email gateways for PDF attachments containing malformed object streams, embedded JavaScript, or suspicious cross-reference tables.

Monitoring Recommendations

Log Acrobat version data across the fleet to identify hosts still running pre-APSB26-141 builds.
Forward endpoint telemetry (process creation, image loads, file writes) to a central data lake for retrospective hunting.
Track document open events correlated with subsequent authentication or credential access activity on the same host.

How to Mitigate CVE-2026-81987

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-141 to all Windows and macOS endpoints running Acrobat or Acrobat Reader.
Prioritize patching for users who routinely open PDFs from external senders, including finance, HR, legal, and executive assistants.
Block or quarantine inbound PDF attachments from untrusted senders at the email gateway pending patch rollout.

Patch Information

Adobe has released fixed versions for both the Classic and Continuous tracks of Acrobat and Acrobat Reader. Refer to the Adobe Acrobat Security Update APSB26-141 for the specific fixed build numbers and download links for Windows and macOS.

Workarounds

Enable Acrobat's Protected View for files originating from the internet and other untrusted locations to constrain parser access to the host.
Disable JavaScript execution within Acrobat via Preferences > JavaScript to reduce the exploit surface exposed by malicious PDFs.
Use application allowlisting or endpoint controls to block Acrobat from spawning shell and scripting interpreters such as cmd.exe and powershell.exe.
Route untrusted PDFs through a sandboxed viewer or browser-based renderer until patching is complete.

bash

# Windows: enforce Protected View for all files via registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f

# Windows: disable Acrobat JavaScript
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f