CVE-2026-47919: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions up to and including 26.001.21651) allows an attacker to achieve arbitrary code execution in the context of the logged-in user. The attack is local in delivery and requires no prior authentication, but does require the victim to open a specially crafted malicious file. Successful exploitation gives the attacker full code execution rights within the user's session, enabling data theft, file tampering, or further system compromise. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service is required to deliver the exploit.

• AuthenticationNot required

  No account or credentials are needed on the target system before exploitation begins.

• Victim interactionRequired

  The victim must open a malicious file, making social engineering or file delivery a necessary step for the attacker.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or memory-layout dependencies are required.

Blast Radius

• A successful attacker executes arbitrary code with the full privileges of the logged-in user, gaining direct control over that user's session.
• Confidential files, stored credentials, and documents accessible to the user can be read and exfiltrated.
• Any files or data the user has write access to can be modified or deleted.
• The user's running processes and applications can be disrupted or hijacked to support further lateral movement.