Executive brief
Adobe Acrobat Reader is a widely used application for viewing and managing PDF documents. A security flaw has been identified where an attacker can take control of a user's computer if the user is tricked into opening a specially crafted, malicious PDF file. This could lead to unauthorized access to personal files, data theft, or the installation of unwanted software.
Technical details
A Use After Free (UAF) vulnerability (CWE-416) exists in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier. The flaw occurs when the application continues to use a pointer after it has been freed, leading to memory corruption. An attacker can exploit this by inducing a user to open a specifically crafted PDF document. Successful exploitation allows for arbitrary code execution in the context of the current user. The attack vector is classified as local with required user interaction (UI:R).
Affected products
- Adobe Acrobat Reader 24.001.30365, 26.001.21651 and earlier versions
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory: Adobe security bulletin APSB26-63 published