CVE-2026-47917: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier, including 24.001.30365 and earlier) allows an attacker to execute arbitrary code on the victim's machine. The vulnerability is triggered locally when a user opens a specially crafted file, requiring no network access or authentication but depending on the victim opening the malicious document. Successful exploitation gives the attacker full code execution in the context of the current user, enabling arbitrary reads, writes, and program execution under that account. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service is involved in triggering this vulnerability.

• AuthenticationNot required

  No account or credentials on the target system are required; the attacker delivers the malicious file through other means such as email or a download.

• Victim interactionRequired

  The victim must open a malicious file, making this a social-engineering vector where the attacker must convince the user to open a crafted document.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code in the context of the logged-in user, giving the attacker full control over any process they spawn under that account.
• Reads files, credentials, session tokens, and any other data accessible to the current user on the host.
• Writes or modifies files on the filesystem, including application binaries, configuration files, and user documents.
• Crashes or terminates the Acrobat Reader process, disrupting document-processing workflows that depend on it.