CVE-2026-47911: Acrobat Reader | Out-of-bounds Write (CWE-787)

Synopsis

An out-of-bounds write vulnerability affects Adobe Acrobat Reader versions 26.001.21651 and earlier (including 24.001.30365 and earlier on the 24.x branch). The vulnerability is triggered locally when a user opens a specially crafted file, requiring no prior authentication but needing the victim to open the malicious document. Successful exploitation gives an attacker arbitrary code execution running as the current user, enabling full control over files and processes accessible to that account. No patched version has been published yet; HarborGuard tracks this advisory and will make a rebuilt image available as soon as Adobe releases a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service exposure is required to trigger this vulnerability.

• AuthenticationNot required

  No account credentials or prior authentication are needed to deliver or trigger the malicious file.

• Victim interactionRequired

  The victim must open a attacker-supplied malicious file, making social engineering (phishing, malicious email attachment, or poisoned download) the primary delivery vector.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file; no race conditions, memory-layout dependencies, or environmental prerequisites are noted in the CVSS vector.

Blast Radius

• Executes arbitrary code as the logged-in user, giving the attacker full control over any files, processes, and credentials accessible to that account.
• Reads sensitive documents, stored credentials, and session tokens present in the user profile or mounted network shares.
• Writes or overwrites files on disk, including application binaries and configuration files reachable by the current user.
• Crashes or terminates the Acrobat Reader process and any dependent workflows, disrupting document-processing pipelines.