CVE-2026-47921: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions 26.001.21651 and earlier, including 24.001.30365 and earlier) allows an attacker to execute arbitrary code on a victim's machine. The attack is local in delivery: no network exposure is needed, but the attacker must convince a user to open a crafted PDF or other malicious file. Successful exploitation gives the attacker full code execution running as the current user, enabling data theft, file modification, or further system compromise. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access to the target; they need an existing shell or process on the host, or a way to deliver a malicious file to the victim.

• AuthenticationNot required

  No account or credentials on the target system are required to trigger the vulnerability.

• Victim interactionRequired

  The victim must actively open a malicious file (such as a crafted PDF), making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or memory-layout knowledge.

Blast Radius

• Reads files, credentials, and session tokens accessible to the current user account.
• Writes or overwrites files on disk under the current user's permissions, including startup items or application configs.
• Executes arbitrary code in the context of the logged-in user, enabling installation of malware or lateral-movement tooling.
• Crashes or corrupts the Acrobat Reader process, causing loss of unsaved document work for the affected user.