CVE-2026-47965: Acrobat Reader | Out-of-bounds Write (CWE-787)

Synopsis

An out-of-bounds write vulnerability affects Adobe Acrobat Reader versions 26.001.21651 and earlier (including 24.001.30365 and earlier in the 24.x line). The flaw is reached locally when a user opens a crafted file, and no authentication is required beyond convincing the victim to open the malicious document. Successful exploitation gives an attacker arbitrary code execution running as the current user. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access path is required.

• AuthenticationNot required

  No account or credential is required to deliver the malicious file; the attack relies solely on the victim opening it.

• Victim interactionRequired

  The victim must open a specially crafted file, making social engineering (phishing, malicious email attachment, or download) a prerequisite.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file; no race conditions or specific memory layout requirements are noted.

Blast Radius

• The attacker executes arbitrary code in the security context of the logged-in user, gaining the same file-system and process permissions that user holds.
• Confidential files accessible to the current user, including documents, credentials cached on disk, and browser-stored secrets, are readable by the attacker.
• The attacker can write or modify files the current user owns, enabling persistence mechanisms such as dropped binaries or altered configuration files.
• The affected Acrobat Reader process and any dependent services can be crashed or destabilized, disrupting the user's workflow.