CVE-2026-47914: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use After Free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier, including 24.001.30365 and earlier) allows an attacker to execute arbitrary code on a target machine. The exploit is local in delivery, requires no prior authentication, but depends on a victim opening a malicious file. Successful exploitation gives the attacker full code execution in the context of the logged-in user, enabling complete compromise of confidentiality, integrity, and availability. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Adobe ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access to the target; they need an existing shell or process on the host, or deliver a malicious file through another channel such as email or download.

• AuthenticationNot required

  No account or credentials on the target system are required to carry out the attack.

• Victim interactionRequired

  The victim must open a malicious file (for example, a crafted PDF), making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Reads any files or secrets accessible to the current user, including stored credentials, session tokens, and personal documents.
• Modifies or deletes files owned by the current user, including application data and configuration files.
• Executes arbitrary code in the user context, enabling installation of malware or lateral movement tooling on the host.
• Crashes or destabilizes Acrobat Reader and any dependent processes running under the same user account.