CVE-2026-81989: Adobe Acrobat Use After Free Vulnerability

CVE-2026-81989 Overview

CVE-2026-81989 is a Use After Free vulnerability [CWE-416] in Adobe Acrobat and Acrobat Reader. The flaw allows an attacker to execute arbitrary code in the context of the current user. Exploitation requires the victim to open a malicious PDF file on an affected system. Adobe published the fix in security bulletin APSB26-141, which covers both Classic and Continuous tracks of Acrobat and Acrobat Reader DC on Windows and macOS.

Critical Impact
A crafted PDF can trigger memory corruption in Acrobat Reader and lead to arbitrary code execution with the privileges of the logged-in user, enabling initial access for follow-on payloads.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Microsoft Windows and Apple macOS installations of the affected Acrobat products

Discovery Timeline

2026-09-08 - CVE-2026-81989 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81989

Vulnerability Analysis

CVE-2026-81989 is a Use After Free condition within Adobe Acrobat and Acrobat Reader. A Use After Free occurs when an application references heap memory after that memory has been freed. An attacker who controls the freed allocation can place attacker-influenced data at the dangling pointer's location. When the application subsequently dereferences the stale pointer, control flow or object state can be redirected into attacker-controlled data.

In Acrobat, parsing of PDF structures triggers allocations and frees across many object graph operations. When a freed object is reused without validation, the resulting dangling reference can be manipulated to hijack execution. Because Acrobat runs with the identity of the logged-in user, successful exploitation grants that user's privileges to the attacker.

Root Cause

The root cause is improper lifetime management of a heap object during PDF processing, classified under [CWE-416: Use After Free]. Adobe has not published low-level technical details of the affected component. See the Adobe Acrobat Security Update Advisory for the authoritative description.

Attack Vector

The attack requires local file access and user interaction. An attacker delivers a malicious PDF through email, a web download, a messaging platform, or a shared file store. When the victim opens the file in a vulnerable version of Acrobat or Acrobat Reader, the crafted document triggers the Use After Free and executes attacker-supplied code in the user's context. No elevated privileges are required for the attacker prior to exploitation.

No public proof-of-concept exploit code has been observed for CVE-2026-81989. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-81989

Indicators of Compromise

Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Acrobat processes writing executable files or scripts to user-writable directories such as %APPDATA%, %TEMP%, or ~/Library/Caches.
Outbound network connections initiated directly by Acrobat processes to previously unseen domains or IP addresses.
Crash telemetry from Acrobat referencing access violations or heap corruption immediately after opening a PDF.

Detection Strategies

Hunt for process-tree anomalies where Acrobat is the parent of shells, scripting hosts, or LOLBins.
Inspect PDF attachments delivered by email for JavaScript, embedded files, or malformed object streams using a sandbox detonator.
Correlate Acrobat crash events with subsequent file writes or persistence activity on the same host within a short time window.

Monitoring Recommendations

Enable endpoint telemetry that captures process creation, module loads, and file writes for Acrobat processes.
Ingest Windows and macOS crash reports into a central data lake to identify clusters of Acrobat failures across the fleet.
Track installed Acrobat and Acrobat Reader versions in asset inventory to identify hosts still exposed to CVE-2026-81989.

How to Mitigate CVE-2026-81989

Immediate Actions Required

Apply the Adobe updates referenced in APSB26-141 to all Acrobat and Acrobat Reader installations on Windows and macOS.
Prioritize patching for users who routinely open PDFs from external sources, including finance, legal, HR, and executive assistants.
Block or quarantine inbound PDFs from untrusted senders at the email gateway until patching is complete.

Patch Information

Adobe released fixed versions of Acrobat DC, Acrobat Reader DC, and Acrobat Classic in security bulletin APSB26-141. Administrators should consult the advisory for the exact fixed build numbers for each track and deploy through the Adobe Update Manager, SCCM, Intune, Jamf, or equivalent management tooling.

Workarounds

Enable Protected View and Protected Mode in Acrobat and Acrobat Reader to constrain the impact of malicious PDFs.
Disable JavaScript in Acrobat through Preferences > JavaScript > Enable Acrobat JavaScript where business processes allow.
Associate .pdf files with a hardened alternative reader on high-risk endpoints until the Adobe patch is deployed.

bash

# Configuration example: disable Acrobat JavaScript via Windows registry (per-user)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f