CVE-2026-81990: Adobe Acrobat Use After Free Vulnerability

CVE-2026-81990 Overview

Adobe Acrobat and Acrobat Reader contain a use-after-free vulnerability [CWE-416] that enables arbitrary code execution in the context of the current user. An attacker crafts a malicious PDF file and delivers it to a victim through email, web download, or other channels. When the victim opens the file in an affected version of Acrobat or Reader, the flaw triggers and executes attacker-controlled code. The issue affects Adobe Acrobat Classic, Acrobat DC Continuous, and Acrobat Reader DC Continuous on both Microsoft Windows and Apple macOS platforms. Adobe published fixes in security bulletin APSB26-141.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the logged-in user, enabling malware installation, data theft, and lateral movement from a single opened PDF.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC (Continuous track) and Acrobat Reader DC (Continuous track)
Apple macOS and Microsoft Windows host platforms

Discovery Timeline

2026-09-08 - CVE-2026-81990 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81990

Vulnerability Analysis

The vulnerability is a use-after-free condition within Adobe Acrobat and Acrobat Reader's PDF parsing and rendering pipeline. Use-after-free defects occur when a program continues to reference heap memory after that memory has been released. An attacker who controls the freed allocation can place crafted data at the reused address and hijack control flow when the dangling pointer is dereferenced.

Exploitation requires user interaction. The victim must open a malicious PDF locally, which matches the local attack vector with required user interaction. No prior authentication or elevated privileges are needed on the target host. Successful exploitation yields arbitrary code execution as the current user, providing full read, write, and execute impact on user-accessible resources.

Adobe classified the issue in bulletin APSB26-141 alongside related Acrobat memory-safety fixes. No public proof-of-concept exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper object lifetime management [CWE-416] inside Acrobat's document processing code. Specific object types are freed while an active pointer still references them. Subsequent operations reuse the pointer, dereferencing memory that the allocator may have reassigned to attacker-controlled data.

Attack Vector

An attacker crafts a PDF containing structures that force the vulnerable code path to free an object and later reuse it. Delivery typically occurs through phishing email attachments, malicious web downloads, or drive-by document links. When Acrobat or Reader opens the file, the dangling reference is triggered, and attacker-supplied data steers execution to shellcode or a Return-Oriented Programming (ROP) chain.

No verified exploit code has been published for CVE-2026-81990. Refer to the Adobe Acrobat Security Update APSB26-141 for vendor-supplied technical context.

Detection Methods for CVE-2026-81990

Indicators of Compromise

PDF files that spawn child processes such as cmd.exe, powershell.exe, wscript.exe, or shell utilities on macOS from AcroRd32.exe or Acrobat.exe.
Unexpected outbound network connections initiated by Acrobat or Reader processes shortly after a PDF is opened.
Acrobat or Reader process crashes with access violations in heap regions, indicating attempted or failed exploitation.
New files written to user-writable directories such as %APPDATA%, %TEMP%, or ~/Library/Application Support/ by the Acrobat process.

Detection Strategies

Monitor Endpoint Detection and Response (EDR) telemetry for Acrobat parent processes launching interpreters or LOLBins.
Alert on Acrobat processes performing script execution, credential access, or persistence actions inconsistent with document viewing.
Ingest email gateway metadata to correlate malicious PDF delivery with subsequent endpoint behavior.

Monitoring Recommendations

Track Acrobat and Reader version inventory across Windows and macOS endpoints to confirm patch coverage.
Enable process command-line logging and PowerShell script-block logging on Windows hosts.
Retain PDF attachments and download URLs for retrospective hunting after new indicators are published.

How to Mitigate CVE-2026-81990

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-141 to all affected Acrobat and Reader installations.
Prioritize systems that regularly process PDFs from external sources, including finance, legal, and executive endpoints.
Restrict PDF handling to patched, current versions and remove end-of-life Acrobat installations.

Patch Information

Adobe released fixed builds for Acrobat Classic, Acrobat DC Continuous, and Acrobat Reader DC Continuous on Windows and macOS. Refer to the Adobe Acrobat Security Update APSB26-141 for exact fixed version numbers and download instructions. Enable automatic updates in Acrobat preferences to reduce future patch latency.

Workarounds

Enable Acrobat Protected View for files originating from the internet and untrusted network locations.
Block or quarantine inbound PDF attachments from external senders at the email security gateway until patches are deployed.
Configure application allowlisting to prevent Acrobat from spawning script interpreters and command shells.

bash

# Windows registry: enforce Protected View for all files in Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f

# Windows registry: disable JavaScript execution in PDFs
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f