CVE-2026-47913: Acrobat Reader | Use After Free (CWE-416)

Synopsis

A use-after-free vulnerability affects Adobe Acrobat Reader versions 26.001.21651 and earlier (including 24.001.30365 and earlier in the 24.x line). The flaw is triggered locally when a user opens a maliciously crafted file, requiring no network exposure and no authenticated account, only a victim who opens the file. Successful exploitation gives the attacker arbitrary code execution running as the current user, enabling full read, write, and control of anything that user can access. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Adobe ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service is involved.

• AuthenticationNot required

  No account or credential is required to trigger the vulnerability; any unprivileged local context is sufficient.

• Victim interactionRequired

  A victim must open a malicious file, making social engineering (email attachment, download link, shared document) the primary delivery vector.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file; no race conditions or special memory-layout requirements apply.

Blast Radius

• Executes arbitrary code as the currently logged-in user, giving the attacker the same file-system and process permissions that user holds.
• Reads any files the user can access, including stored credentials, session tokens, and personal or corporate documents.
• Writes or modifies files owned by the user, enabling persistence mechanisms such as dropped binaries or altered configuration files.
• Crashes or destabilizes Acrobat Reader and any dependent workflows, disrupting document processing for the affected user session.