CVE-2026-47912: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier) allows an attacker to achieve arbitrary code execution in the context of the logged-in user. The attack is local in delivery but requires a victim to open a malicious file, making it a social-engineering vector rather than a remotely exploitable network service. Successful exploitation gives the attacker full read, write, and execution capabilities within the current user session. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched rebuild the moment Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access to the target; exploitation relies on the victim opening a malicious file on their local machine.

• AuthenticationNot required

  No account or credentials on the target system are required to deliver the malicious file; the attack is carried through a crafted document.

• Victim interactionRequired

  The victim must actively open a malicious file, meaning the attacker must convince the user to do so through phishing, download, or another social-engineering method.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads any files and data accessible to the current user account, including stored credentials, documents, and session tokens.
• Modifies or overwrites files within the current user's permissions scope, including application data and configuration files.
• Executes arbitrary code as the current user, enabling installation of malware, backdoors, or further lateral-movement tooling.
• Crashes or destabilizes the Acrobat Reader process, causing loss of unsaved work and potential disruption to dependent workflows.