CVE-2026-80160

Acrobat Reader | Out-of-bounds Read (CWE-125)

Published Sep 8, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Analysis

Technical impact

An out‑of‑bounds read flaw in Adobe Acrobat Reader can expose sensitive memory contents. If an attacker crafts a malicious PDF, the flaw may reveal confidential data without authentication. The vulnerability is caused by a lack of bounds checking when processing the file, which corresponds to CWE‑125.

Affected Systems

Adobe Acrobat 2024, Adobe Acrobat Reader, and other Adobe Acrobat products are vulnerable. The issue applies to the editions listed by Adobe as part of the 2024 release series.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. Exploitation requires user action—specifically opening a malicious document—so the attack vector is user‑interaction based and cannot be executed remotely without such action. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting current exploitation risk is limited to targeted, social‑engineering scenarios.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Adobe

Adobe Acrobat

unaffected

Version	Status	Constraints
`0`	affected	≤ 26.002.21900
`26.002.21901`	unaffected	—

Adobe

Acrobat Reader

unaffected

Version	Status	Constraints
`0`	affected	≤ 26.002.21900
`26.002.21901`	unaffected	—

Adobe

Acrobat 2024

unaffected

Version	Status	Constraints
`0`	affected	≤ 24.001.30383
`24.001.30429`	unaffected	—

Configuration 1 [-]

AND

OR	cpe:2.3:a:adobe:acrobat:::::classic:::*
	cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Versions

Adobe

Acrobat

Version	Status	Scheme	Platform
`[0,26.002.21900]`	affected	generic	—
`26.002.21901`	unaffected	generic	—

Adobe

Acrobat 2024

Version	Status	Scheme	Platform
`[0,24.001.30383]`	affected	generic	—
`24.001.30429`	unaffected	generic	—

Adobe

Acrobat Reader

Version	Status	Scheme	Platform
`[0,26.002.21900]`	affected	generic	—
`26.002.21901`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update all Adobe Acrobat and Acrobat Reader installations to the latest vendor‑supplied patch or cumulative update released by Adobe.
Configure systems to restrict automatic opening of PDF files or to launch PDF content in a sandboxed environment when possible.
Deploy endpoint protection that scans inbound PDFs for known malicious patterns and blocks or quarantines suspicious files.

Generated by OpenCVE AI on September 9, 2026 at 09:13 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.261% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://helpx.adobe.com/security/products/acrobat/apsb26-141.html

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Adobe acrobat 2024 Adobe acrobat Reader
Vendors & Products		Adobe acrobat 2024 Adobe acrobat Reader

Sep 10, 2026 3:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Dc Apple Apple macos Microsoft Microsoft windows
CPEs		cpe:2.3:a:adobe:acrobat:::::classic:::* cpe:2.3:a:adobe:acrobat_dc:::::continuous:::* cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Adobe Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Dc Apple Apple macos Microsoft Microsoft windows

Sep 9, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 8, 2026 8:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title		Acrobat Reader \| Out-of-bounds Read (CWE-125)
Weaknesses		CWE-125
References		https://helpx.adobe.com/security/products/acrobat/apsb26-141.html
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}`