Description
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-09-08
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Acrobat Readers are subject to a Use After Free condition that can lead to arbitrary code execution. The flaw allows attackers to trigger execution of malicious code within the process that opens a crafted PDF document. If successful, the attacker can gain code execution rights with the privileges of the user who opens the file.

Affected Systems

Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat 2024 are listed as affected. No specific version ranges are given, so any installation of these products that has not yet applied the security bulletin APSB26‑141 may be vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. The EPSS score is unavailable, but the flaw requires user interaction to open a malicious file, limiting its exploitability to social‑engineering scenarios. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog.

Generated by OpenCVE AI on September 9, 2026 at 09:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Adobe Acrobat or Acrobat Reader update available in Security Bulletin APSB26‑141 from Adobe’s support site.
  • Avoid opening PDF files from untrusted sources to reduce the risk of a malicious file being opened.
  • Configure Acrobat settings to disable automatic download of external content, or run the PDF viewer in a sandboxed environment to isolate it from critical system components.

Generated by OpenCVE AI on September 9, 2026 at 09:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe acrobat 2024
Adobe acrobat Reader
Vendors & Products Adobe acrobat 2024
Adobe acrobat Reader

Thu, 10 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe acrobat
Adobe acrobat Dc
Adobe acrobat Reader Dc
Apple
Apple macos
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe acrobat
Adobe acrobat Dc
Adobe acrobat Reader Dc
Apple
Apple macos
Microsoft
Microsoft windows

Wed, 09 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Acrobat Reader | Use After Free (CWE-416)
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Acrobat Acrobat 2024 Acrobat Dc Acrobat Reader Acrobat Reader Dc
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-09-09T09:54:40.613Z

Reserved: 2026-08-25T14:55:21.139Z

Link: CVE-2026-79909

cve-icon Vulnrichment

Updated: 2026-09-09T09:51:08.790Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T21:18:42.640

Modified: 2026-09-10T15:40:50.280

Link: CVE-2026-79909

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T03:45:18Z

Weaknesses