CVE-2026-47920: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier, including 24.001.30365 and earlier) allows arbitrary code execution when a victim opens a malicious file. The attack is local-delivery but requires no special account privileges, only that a user opens a crafted document. Successful exploitation gives the attacker full code execution in the context of the logged-in user, enabling data theft, file tampering, or further system compromise. No upstream fix has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required, only delivery of a malicious file to the victim.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the vulnerability is reachable by any user who opens a crafted file.

• Victim interactionRequired

  The victim must open a malicious file, making this a social-engineering vector that requires tricking the user into accessing a crafted document.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other environmental pre-conditions beyond file delivery.

Blast Radius

• Reads files and data accessible to the current user, including stored credentials, documents, and session tokens.
• Modifies or deletes files the current user has write access to, including configuration and application data.
• Executes arbitrary code in the context of the logged-in user, enabling installation of malware or backdoors.
• Provides a foothold for lateral movement or privilege escalation if the victim account has elevated permissions.