CVE-2026-82001: Adobe Acrobat DOS Vulnerability

CVE-2026-82001 Overview

Adobe Acrobat and Acrobat Reader contain an uncontrolled resource consumption vulnerability [CWE-400] that can trigger an application denial-of-service condition. An attacker crafts a malicious PDF that, when opened, exhausts system resources on the victim's machine. Exploitation requires user interaction: the victim must open the malicious file. The flaw affects both Classic and Continuous release tracks of Acrobat and Acrobat Reader DC on Windows and macOS. Adobe published a security bulletin (APSB26-141) addressing the issue.

Critical Impact
Successful exploitation renders Acrobat unresponsive and can degrade host performance until the process is terminated, disrupting document review workflows.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Microsoft Windows and Apple macOS installations of the above

Discovery Timeline

2026-09-08 - CVE-2026-82001 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-82001

Vulnerability Analysis

The vulnerability is an uncontrolled resource consumption weakness in Adobe Acrobat and Acrobat Reader. Acrobat fails to enforce bounds on a resource-allocating operation triggered while parsing or rendering a PDF. A malicious document forces the application to consume excessive memory, CPU cycles, or file handles until the process becomes unresponsive. The attack vector is local because delivery depends on the victim opening the file, but the malicious PDF itself can be distributed through email, web downloads, or shared drives. Confidentiality and integrity are not impacted; only availability suffers, which limits the flaw to denial-of-service outcomes.

Root Cause

The underlying weakness maps to [CWE-400: Uncontrolled Resource Consumption]. Acrobat processes an attacker-controlled structure inside the PDF without imposing effective limits on the resources allocated during parsing. Adobe's advisory APSB26-141 identifies the defect but does not publish the specific object type or code path affected.

Attack Vector

An attacker crafts a PDF file containing structures that cause Acrobat to allocate resources without an effective ceiling. The attacker then delivers the file through phishing, drive-by download, or a compromised document repository. When a user opens the file in a vulnerable Acrobat build, resource consumption climbs until the application freezes or crashes. No network access to the target is required, and no elevated privileges are needed to trigger the condition. The vulnerability cannot be exploited without user interaction, which restricts opportunistic mass exploitation.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. See the Adobe Acrobat Security Update APSB26-141 for vendor-supplied technical context.

Detection Methods for CVE-2026-82001

Indicators of Compromise

Acrobat or Acrobat Reader processes (Acrobat.exe, AcroRd32.exe) with sustained CPU near 100% or rapidly growing private working set after opening a PDF
Application hangs, unresponsive UI, or crash reports referencing Acrobat immediately following document open events
Recently received PDF attachments from untrusted senders correlated with post-open resource spikes

Detection Strategies

Monitor endpoint telemetry for Acrobat child processes exhibiting anomalous memory growth or CPU saturation within seconds of file open
Flag PDFs arriving from external senders that contain unusually large or deeply nested object structures during email gateway inspection
Correlate Windows Application event log crash entries for Acrobat.exe and AcroRd32.exe with recent file-open activity in EDR data

Monitoring Recommendations

Track Acrobat version inventory across managed endpoints and alert on hosts running builds prior to those listed in APSB26-141
Log and review PDF file provenance for documents that trigger Acrobat crashes to support incident triage
Watch for repeated Acrobat crashes on the same endpoint, which may indicate an attacker retrying delivery of a malicious document

How to Mitigate CVE-2026-82001

Immediate Actions Required

Apply the Acrobat and Acrobat Reader updates published in Adobe Security Bulletin APSB26-141 on all Windows and macOS endpoints
Prioritize patching endpoints belonging to users who routinely open external PDFs, such as legal, finance, and HR staff
Enable automatic updates in Acrobat so future out-of-band fixes reach endpoints without administrator intervention

Patch Information

Adobe addressed CVE-2026-82001 in the security update documented in APSB26-141. Administrators should consult the bulletin for the exact fixed build numbers for the Classic and Continuous release tracks and deploy them through their standard patch management pipeline.

Workarounds

Enable Acrobat Protected View for files originating from the internet and other untrusted locations to constrain document processing
Use email gateway and web proxy controls to block or sandbox PDF attachments from untrusted senders until patching is complete
Advise users to avoid opening unsolicited PDF attachments and to report suspicious documents to the security team

bash

# Windows: enable Protected View for all untrusted PDFs via registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bProtectedMode /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f