CVE-2026-47915: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier, including 24.001.30365 and earlier) allows an attacker to execute arbitrary code on the victim's machine. The exploit is local-vector, requiring no authentication, but the victim must open a malicious file such as a crafted PDF. Successful exploitation gives the attacker full code execution in the context of the current user, enabling data theft, file modification, or further system compromise. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required.

• AuthenticationNot required

  No account or credentials are needed to exploit this vulnerability; the attacker delivers the malicious file without authenticating to any service.

• Victim interactionRequired

  A victim must open a malicious file (for example, a crafted PDF) for the use-after-free to be triggered, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no specific race conditions, memory layout dependencies, or other environmental factors beyond victim file-open.

Blast Radius

• Executes arbitrary code in the context of the logged-in user, giving the attacker the same file-system and process permissions as that user.
• Reads files accessible to the current user, including documents, credentials stored on disk, and browser session data.
• Writes or modifies files owned by the current user, enabling persistence mechanisms such as dropped binaries or modified startup scripts.
• Crashes or destabilizes the Acrobat Reader process, disrupting document workflows dependent on it.