CVE-2026-47952: Acrobat Reader | Heap-based Buffer Overflow (CWE-122)

Synopsis

A heap-based buffer overflow vulnerability affects Adobe Acrobat Reader versions 26.001.21651 and earlier (including 24.001.30365 and earlier in the 24.x line). The vulnerability is exploited locally, requires no prior authentication, but does require a victim to open a specially crafted malicious file. Successful exploitation gives an attacker arbitrary code execution running as the current user, enabling full read, write, and control over anything that user can access. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-level access to the target service is required.

• AuthenticationNot required

  No account or credential is needed before launching the attack; the exploit is delivered entirely through a malicious file.

• Victim interactionRequired

  A victim must be socially engineered into opening a malicious file, such as a crafted PDF, for the overflow to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the victim opening the file.

Blast Radius

• An attacker achieves arbitrary code execution running as the current user, giving them full control over any process they can spawn in that context.
• All files, secrets, and credentials readable by the victim user become accessible to the attacker.
• The attacker can write or modify any file the victim user has write access to, including application data, configuration files, and stored documents.
• The affected process and any child processes can be terminated or destabilized, disrupting the user's session and any dependent workflows.