CVE-2026-47959: Acrobat Reader | Stack-based Buffer Overflow (CWE-121)

Synopsis

Stack-based buffer overflow in Adobe Acrobat Reader (versions 26.001.21651 and earlier, including 24.001.30365 and earlier) allows an attacker to execute arbitrary code on the victim's machine. The vulnerability is local in nature and requires no prior authentication, but the victim must open a specially crafted malicious file. Successful exploitation gives the attacker full code execution in the context of the logged-in user, enabling data theft, file manipulation, or further system compromise. No fix version has been published yet; HarborGuard tracks the advisory and will surface patch availability as soon as Adobe releases an update.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required.

• AuthenticationNot required

  No account or credentials are required to deliver the malicious file to the victim.

• Victim interactionRequired

  The victim must actively open a malicious file, making this a social-engineering vector typically delivered via email attachment or a crafted download link.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file, with no race conditions or special memory-layout requirements.

Blast Radius

• The attacker executes arbitrary code in the context of the logged-in user, gaining the same filesystem and process privileges as that user.
• Files accessible to the current user, including documents, credentials cached on disk, and browser profile data, can be read and exfiltrated.
• The attacker can write or modify files owned by the current user, including configuration files and application data.
• The running Acrobat Reader process and any child processes the attacker spawns can be terminated or repurposed, disrupting document workflows.