rootpwn

high · CVSS v3 7.1

CVE-2026-91794

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash…

Description

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when handling certain U3D files, PRC files, AcroForms, JPEG/JPEG2000 images, or annotations with malformed streams or data, which attackers could exploit to execute remote code or disclose information. This occurs due to a lack of proper validation of user-supplied data before performing operations on objects.

Scores

Severity
high
CVSS v2
5.8
CVSS v3
7.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-91789

Adobe Acrobat Reader and related PDF processing components are vulnerable to an out-of-bounds read/write when parsing malformed U3D, PRC, AcroForms, JPEG/JPEG2000, or annotation streams. The flaw can cause crashes or remote code execution, potentially exposing sensitive data or allowing attackers to compromise systems. It is critical for organizations that rely on PDF handling to apply patches promptly.

View analysis

high

CVE-2026-91790

CVE-2026-91790 is a Use-After-Free flaw in PDF viewer software that can crash or allow remote code execution when handling specific image, annotation, JavaScript array, page, or form field objects. The vulnerability occurs due to improper validation of freed objects, potentially exposing sensitive data or enabling attackers to execute code. It carries a high severity rating with a CVSS v3 score of 8.1.

View analysis

high

CVE-2026-91791

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain image objects, annotation objects, JavaScript array objects, page objects, or form fields, which attackers could exploit to disclose information or execute remote code. This occurs due to the access to an object that has been freed or released without proper validation.

View analysis

high

CVE-2026-91792

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain image objects, annotation objects, JavaScript array objects, page objects, or form fields, which attackers could exploit to disclose information or execute remote code. This occurs due to the access to an object that has been freed or released without proper validation.

View analysis