CVE-2026-47916: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier, including 24.001.30365 and earlier) allows an attacker to execute arbitrary code in the context of the logged-in user. The attack is local in delivery, requires no authentication, but depends on a victim opening a specially crafted malicious file. Successful exploitation gives the attacker full code execution, enabling data theft, file tampering, or further compromise of the host. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or the ability to deliver a malicious file locally; no over-the-network service exposure is required.

• AuthenticationNot required

  No account or credentials are required to stage the attack; the attacker only needs to get the victim to open a crafted file.

• Victim interactionRequired

  A victim must actively open a malicious file, making social engineering (for example, a phishing email with an attached PDF) the primary delivery vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Reads files and data accessible to the current user, including stored documents, credentials cached on disk, and browser profile data.
• Modifies or deletes files within the current user's permission scope, including application data and configuration files.
• Executes arbitrary processes as the current user, enabling installation of malware, creation of persistence mechanisms, or lateral movement within the host.
• Crashes or destabilizes the Acrobat Reader process, causing loss of any unsaved work open at the time of exploitation.