CVE-2026-47918: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use After Free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier) allows an attacker to execute arbitrary code in the context of the current user. The attack is local in nature and requires no prior authentication, but relies on a victim opening a malicious file. Successful exploitation gives the attacker full code execution capabilities under the victim's user account. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as Adobe ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger this vulnerability.

• AuthenticationNot required

  No account or credentials are needed on the target system before the exploit can be attempted.

• Victim interactionRequired

  A victim must be socially engineered into opening a maliciously crafted file, such as a PDF delivered via email or download.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file; no race conditions or special memory-layout requirements apply.

Blast Radius

• The attacker executes arbitrary code under the victim user's account, gaining full access to everything that account can do on the host.
• Confidential files readable by the victim user (documents, credentials, session tokens stored on disk) are exposed to the attacker.
• The attacker can write or modify files owned by the victim user, including application data, configuration files, and persisted state.
• The attacker can crash or destabilize Acrobat Reader and any dependent processes running under the same user context.