CVE-2026-81991: Adobe Acrobat Information Disclosure Flaw

CVE-2026-81991 Overview

CVE-2026-81991 is an out-of-bounds read vulnerability [CWE-125] affecting Adobe Acrobat and Acrobat Reader on both Windows and macOS. An attacker who convinces a user to open a crafted file can read memory outside the intended buffer boundary, disclosing sensitive process information. The flaw does not permit code execution or data modification on its own, but leaked memory contents can support broader exploitation chains by defeating mitigations such as Address Space Layout Randomization (ASLR).

Adobe published security bulletin APSB26-141 describing the issue and the corresponding patched builds.

Critical Impact
A single malicious PDF opened by a user can expose sensitive process memory from Acrobat or Acrobat Reader, aiding follow-on attacks against the endpoint.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Adobe Acrobat and Reader on Microsoft Windows and Apple macOS

Discovery Timeline

2026-09-08 - CVE-2026-81991 published to the National Vulnerability Database
2026-09-10 - CVE record last modified in NVD

Technical Details for CVE-2026-81991

Vulnerability Analysis

The issue is an out-of-bounds read within Acrobat's file parsing logic. When Acrobat processes a specially crafted document, it reads memory past the boundary of an allocated buffer. The read data is not sanitized before it is used or reflected inside the process, allowing an attacker to obtain fragments of adjacent heap or stack memory.

Because the confidentiality impact is high while integrity and availability are unaffected, this class of bug is typically chained with a second primitive. Leaked pointers can be used to bypass ASLR before triggering a separate memory corruption vulnerability that grants code execution.

Exploitation is local and requires user interaction: a victim must open a malicious file delivered through email, a web download, or a shared workspace.

Root Cause

The root cause is missing or insufficient bounds validation on an index or length field parsed from the document structure. Acrobat trusts an attacker-controlled size when reading from a buffer, causing the parser to walk past the allocation and return uninitialized or unrelated memory to the caller. This behavior maps to CWE-125 (Out-of-bounds Read).

Attack Vector

An attacker crafts a PDF or related file containing malformed structures that trigger the vulnerable parser path. The file is delivered to the victim through phishing, a compromised website, or file sharing. When the victim opens the document in a vulnerable Acrobat or Reader build on Windows or macOS, the out-of-bounds read fires within the Acrobat process context and exposes memory contents to attacker-controlled logic embedded in the document.

No authentication or network access is required. The attack succeeds under the privileges of the user opening the file.

See the Adobe Acrobat Security Advisory APSB26-141 for vendor technical details.

Detection Methods for CVE-2026-81991

Indicators of Compromise

Acrobat or Reader processes (Acrobat.exe, AcroRd32.exe, AdobeAcrobat) opening PDF files sourced from email attachments, browser downloads, or temporary internet folders followed by anomalous child process activity.
Unexpected outbound network connections initiated by an Acrobat process shortly after a document is opened.
Application crash telemetry referencing Acrobat modules with access violation exceptions during PDF parsing.

Detection Strategies

Hunt for Acrobat processes spawning shells, scripting engines (powershell.exe, wscript.exe, cmd.exe, osascript), or LOLBins immediately after opening a document.
Correlate document-open events with process memory read anomalies or handle access to LSASS and other sensitive processes originating from Acrobat.
Inspect PDF submissions in email and web gateways for malformed cross-reference tables, oversized stream objects, and other structural anomalies associated with parser exploitation.

Monitoring Recommendations

Enable process and file telemetry for Acrobat binaries and forward events to a centralized data lake for retrospective hunting.
Track installed Acrobat and Reader versions across the fleet and alert on hosts running builds older than the fixed versions listed in APSB26-141.
Monitor Windows Error Reporting and macOS crash reports for repeated Acrobat faults in file parsing modules, which can indicate exploitation attempts.

How to Mitigate CVE-2026-81991

Immediate Actions Required

Apply the patched Acrobat and Acrobat Reader builds identified in Adobe bulletin APSB26-141 on all Windows and macOS endpoints.
Prioritize systems that regularly process externally sourced PDFs, such as executive assistants, HR, finance, and legal workstations.
Reinforce user awareness that unsolicited PDF attachments should not be opened, particularly from unknown senders.

Patch Information

Adobe released fixed versions for both the Continuous (Acrobat DC, Acrobat Reader DC) and Classic tracks. Refer to the Adobe Acrobat Security Advisory APSB26-141 for the exact patched build numbers per track and platform. Deploy updates through Adobe Update Server, Microsoft Intune, Jamf, or the enterprise patch management tooling used in your environment.

Workarounds

Enable Acrobat Protected View for files originating from the internet and other untrusted locations to constrain the parser sandbox.
Use the Adobe Customization Wizard or enterprise policy to disable JavaScript in PDFs where business requirements permit.
Route inbound PDFs through a content disarm and reconstruction (CDR) gateway or detonate them in a sandbox before delivery.

bash

# Windows: disable Acrobat JavaScript enterprise-wide via registry
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f

# Windows: force Protected View for all untrusted files
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f