Adobe Acrobat Reader DC Font Parsing Use‑After‑Free Information Disclosure (CVE‑2026‑80162)

What Happened

Adobe Acrobat Reader DC contains a use‑after‑free vulnerability in the parsing of embedded fonts. The flaw occurs when the parser fails to validate the existence of an object before operating on it, allowing a crafted document to trigger a memory read that exposes internal data.

Impact

The vulnerability can disclose sensitive information to a remote attacker who successfully delivers a malicious PDF or web page that the user opens. The CVSS score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). While it does not directly allow code execution, it can be combined with other weaknesses to elevate privileges or execute arbitrary code within the current process context.

What to Do

• Verify that all installations of Acrobat Reader DC are running the latest version (Adobe has released a patch for CVE‑2026‑80162).
• Apply the update immediately; the fix removes the unsafe font‑parsing logic.
• Restrict user access to untrusted PDF sources and enforce strict content‑type filtering on web servers to reduce the risk of accidental exposure.
• Monitor for anomalous memory access patterns or unexpected data disclosures in your environment.

Additional Notes

Adobe’s advisory notes that the flaw is user‑interaction dependent and that no active exploitation has been observed in the wild. Nonetheless, the patch should be applied without delay to mitigate potential future attacks.