Vulnerabilities
Adobe Acrobat Reader RCE Exploited – Patch Immediately
A remote code execution vulnerability in Adobe Acrobat Reader DC allows attackers to execute arbitrary code via a crafted PDF. The flaw is present in versions 22.x and earlier and has been actively exploited in the wild. Defenders should apply the latest patch, disable JavaScript in PDFs, and monitor for anomalous outbound connections.
Adobe released a critical RCE fix for Acrobat Reader DC after attackers leveraged a crafted PDF to execute code on victim machines. The vulnerability, identified as CVE-2026-XXXX, exists in all 22.x releases and earlier.
What happened
Malicious actors embedded malicious JavaScript in a PDF that triggers a buffer overflow in the PDF parser, allowing arbitrary code execution with the privileges of the current user.
Impact
- Remote code execution on Windows, macOS, and Linux systems running affected Acrobat Reader versions.
- Potential for credential theft, lateral movement, and ransomware deployment.
- High severity (CVSS 9.8).
What to do
- Update Acrobat Reader to the latest version (22.012.20043 or newer) immediately.
- Disable JavaScript in PDF settings if not required.
- Implement application whitelisting to block unapproved executables.
- Monitor for unusual outbound traffic from PDF processes.
- Conduct a quick audit of user accounts for privilege escalation signs.
Mitigation steps
Apply Adobe's patch, enforce least privilege for PDF viewing, and use endpoint detection to flag anomalous process creation.
Related vulnerabilities
Adobe Acrobat Reader DC Annotation Use-After-Free RCE Vulnerability (CVE-2026-81986)
Adobe has disclosed a use‑after‑free flaw in Acrobat Reader DC that allows remote attackers to execute code when a user opens a malicious PDF or visits a crafted web page. The vulnerability, CVE‑2026‑81986, carries a CVSS score of 7.8 and requires user interaction. Defenders should verify patch status and update to the latest Reader version.
Read briefing
Adobe Acrobat Reader DC Annotation Use-After-Free RCE Vulnerability (CVE-2026-81976)
A use‑after‑free flaw in Adobe Acrobat Reader DC’s annotation handling allows remote attackers to execute arbitrary code when a user opens a crafted PDF or visits a malicious web page. The vulnerability, CVE‑2026‑81976, carries a CVSS score of 7.8 and requires user interaction. Defenders should patch to the latest Reader version and monitor for suspicious PDF activity.
Read briefing
Adobe Acrobat Reader DC Font Parsing Use‑After‑Free Information Disclosure (CVE‑2026‑80162)
A use‑after‑free flaw in Adobe Acrobat Reader DC’s embedded‑font parsing can leak sensitive data when a user opens a crafted PDF or visits a malicious web page. The CVSS score is 3.3 and requires user interaction. Adobe has released a patch; defenders should verify installations and apply the update immediately.
Read briefing
JPCERT/CC Issues Alert for Critical Arbitrary Code Execution Flaws in Adobe Acrobat and Reader (APSB26-141)
JPCERT/CC has published an advisory regarding critical vulnerabilities in Adobe Acrobat and Reader across Windows and macOS platforms. Successful exploitation could allow an attacker to execute arbitrary code via malicious PDF content. Defenders must immediately apply the latest software updates provided by Adobe.
Read briefing