CVE-2026-47937: Acrobat Reader | Uncontrolled Search Path Element (CWE-427)

Synopsis

An Uncontrolled Search Path Element vulnerability affects Adobe Acrobat Reader versions 26.001.21651 and earlier (including 24.001.30365 and earlier in the 24.x line). The attack requires local access to the host, admin-level privileges, and a victim to open a malicious file; the CVSS vector reflects a scope change, meaning the impact can extend beyond the Acrobat Reader process itself. Successful exploitation enables arbitrary code execution in the context of the current user, with high confidentiality and integrity impact. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild as soon as Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required.

• AuthenticationRequired

  An admin or otherwise privileged account is needed to place or manipulate the search path entry exploited by this vulnerability.

• Victim interactionRequired

  A victim must open a malicious file, making this dependent on a social-engineering step to deliver and trigger the payload.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout conditions.

Blast Radius

• Executes arbitrary code in the context of the user running Acrobat Reader, inheriting that user's file-system and process permissions.
• Reads files and data accessible to the current user, including documents, cached credentials, and browser profile data on the host.
• Modifies or overwrites files accessible to the current user, enabling persistence mechanisms or tampering with local application state.
• Because scope is changed, the exploit can affect resources and processes outside the Acrobat Reader security boundary on the same host.