CVE-2026-47955: Acrobat Reader | Use After Free (CWE-416)

Synopsis

Use-after-free vulnerability in Adobe Acrobat Reader (versions up to 26.001.21651 and 24.001.30365) allows arbitrary code execution in the context of the logged-in user. The attacker does not need network access or any account credentials, but must convince a victim to open a specially crafted file. Successful exploitation gives the attacker full code execution under the victim's user account. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service exposure is required.

• AuthenticationNot required

  No account credentials or privileges are needed; the attack is delivered entirely through a malicious file.

• Victim interactionRequired

  The victim must open a malicious file, making this a social-engineering vector where the attacker must persuade the target to do so.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental prerequisites beyond the victim opening the file.

Blast Radius

• Executes arbitrary code under the victim's user account, giving the attacker full control of any process the user can run.
• Reads any files, credentials, or secrets accessible to the current user, including browser-stored tokens and documents.
• Modifies or deletes files and configuration data within the user's permission scope.
• Crashes or destabilizes the Acrobat Reader process and any dependent workflows relying on it.