CVE-2026-47917: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2026-47917 is a Use After Free vulnerability in Adobe Acrobat Reader that could result in arbitrary code execution in the context of the current user. It affects Adobe Acrobat DC and Acrobat Reader DC versions up to 26.001.21651 (Continuous track) and Acrobat 2024 versions up to 24.001.30365 (Classic track) on Windows and macOS. The vulnerability was disclosed and patched on June 9, 2026, with Adobe releasing security updates as part of its June 2026 patch cycle. It carries a CVSS v3.1 base score of 7.8 (High) (Adobe Advisory, ZDI).

The vulnerability is classified as CWE-416 (Use After Free), meaning the application references memory after it has been freed, potentially leading to memory corruption and arbitrary code execution. The attack vector is local, requiring no special privileges, but does require user interaction — specifically, a victim must open a specially crafted malicious file (e.g., a PDF). The low attack complexity suggests that once a malicious file is delivered to the victim, exploitation does not require additional conditions or race conditions to be met (Adobe Advisory, ZDI).

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the user running Adobe Acrobat Reader, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could read sensitive documents, modify files, install malware, or use the compromised session as a foothold for further lateral movement within the network. The scope is limited to the current user context, but in environments where users have elevated privileges, the impact could be significantly broader (Adobe Advisory).

1. Craft a malicious file: An attacker creates a specially crafted PDF or supported file format that triggers the use-after-free condition in Adobe Acrobat Reader's memory management routines.
2. Deliver the file: The attacker distributes the malicious file via phishing email, malicious website, or other social engineering methods to lure the victim into opening it.
3. Victim opens the file: The victim opens the malicious file using a vulnerable version of Adobe Acrobat Reader (≤26.001.21651 or ≤24.001.30365).
4. Trigger use-after-free: Opening the file triggers the UAF condition, causing Acrobat Reader to reference previously freed memory, leading to memory corruption.
5. Achieve code execution: The attacker's payload leverages the memory corruption to redirect execution flow and run arbitrary code in the context of the current user, potentially deploying a backdoor, ransomware, or other malicious payload (Adobe Advisory, ZDI).

• Process: Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe (e.g., cmd.exe, powershell.exe, wscript.exe, or network utilities like curl or wget).
• Network: Outbound connections from Acrobat Reader processes to unknown or suspicious external IP addresses or domains shortly after opening a PDF file.
• File System: Newly created or modified executable files, scripts, or DLLs in user-writable directories (e.g., %APPDATA%, %TEMP%) following the opening of a PDF document.
• Logs: Windows Event Logs showing unusual process creation events (Event ID 4688) with AcroRd32.exe or Acrobat.exe as the parent process; application crash logs or Dr. Watson/WER reports related to Acrobat Reader.
• Memory: Crash dumps or heap corruption indicators in Acrobat Reader process memory, potentially flagged by endpoint detection tools.

Adobe has released patched versions addressing this vulnerability: Acrobat DC and Acrobat Reader DC should be updated to version 26.001.21662 or later, and Acrobat 2024 (Classic track) should be updated to version 24.001.30383 or later. Users should apply these updates immediately via Adobe's built-in update mechanism (Help > Check for Updates) or through enterprise deployment tools. As a temporary workaround until patching is possible, users should be advised not to open PDF files from untrusted or unknown sources (Adobe Advisory).

Adobe disclosed the vulnerability as part of its June 2026 security update cycle, and the Zero Day Initiative published a corresponding advisory (ZDI-26-352) on the same day. CISA included the vulnerability in its weekly vulnerability bulletin (SB26-166), and security aggregators such as BeyondMachines and Fortress SRM highlighted it in their June 2026 threat roundups. No significant independent researcher commentary or social media discussion has been observed beyond standard patch notification coverage (Adobe Advisory, ZDI).