CVE-2026-47955: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2026-47955 is a Use After Free (UAF) vulnerability in Adobe Acrobat Reader and Adobe Acrobat that could allow arbitrary code execution in the context of the current user. It affects Adobe Acrobat DC and Acrobat Reader DC versions 26.001.21651 and earlier (continuous track), and Acrobat 2024 versions 24.001.30365 and earlier on Windows and macOS. Adobe disclosed and patched this vulnerability on June 9, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Adobe Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring when Acrobat Reader references memory that has already been freed during the processing of a malicious PDF file. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a specially crafted malicious file. Successful exploitation triggers the use-after-free condition, which can be leveraged to redirect execution flow and achieve arbitrary code execution within the application's process context (Adobe Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the user who opens the malicious PDF, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files, modify data, install malware, or crash the application. The scope is limited to the current user's context, but on systems where users operate with elevated privileges, the impact could extend further (Adobe Advisory).

1. Craft a malicious PDF: An attacker creates a specially crafted PDF file designed to trigger the use-after-free condition in Adobe Acrobat Reader's PDF parsing engine.
2. Deliver the payload: The attacker distributes the malicious PDF via phishing email, malicious website, or other social engineering channels to lure a victim into opening the file.
3. Victim opens the file: The victim opens the malicious PDF using a vulnerable version of Adobe Acrobat Reader (≤26.001.21651 or Acrobat 2024 ≤24.001.30365).
4. Trigger the UAF condition: The PDF parser frees a memory object but continues to reference it, allowing the attacker to control the freed memory region.
5. Achieve code execution: By controlling the freed memory, the attacker redirects execution flow to a shellcode or ROP chain, executing arbitrary code in the context of the current user (Adobe Advisory).

• File System: Unexpected files written to user temp directories (e.g., %TEMP% on Windows or /tmp on macOS) by the Acrobat Reader process; new or modified files in Acrobat plugin directories.
• Process: Unusual child processes spawned by AcroRd32.exe or Acrobat.exe (e.g., cmd.exe, powershell.exe, bash, curl, wget); unexpected network connections initiated by the Acrobat process.
• Network: Outbound connections from Acrobat Reader to unknown or suspicious external IP addresses or domains shortly after opening a PDF file.
• Logs: Application crash logs or Windows Error Reporting entries referencing Acrobat Reader with memory access violations; macOS crash reports for AdobeReader or Acrobat processes.

Adobe released patched versions on June 9, 2026: Acrobat DC and Acrobat Reader DC should be updated to version 26.001.21662 or later (continuous track), and Acrobat 2024 should be updated to version 24.001.30383 or later. Users should apply these updates immediately via Adobe's built-in updater or by downloading directly from Adobe. As a temporary workaround, users should avoid opening PDF files from untrusted or unknown sources, and consider disabling automatic PDF opening in web browsers until patching is complete (Adobe Advisory).

Adobe's June 2026 patch batch, which included this vulnerability, was covered by security aggregators and threat intelligence platforms including BeyondMachines and Fortress SRM as part of their monthly patch roundups. CISA included the advisory in its weekly vulnerability bulletin (SB26-166). No notable individual researcher commentary or significant social media discussion specific to CVE-2026-47955 has been observed, consistent with the absence of a public exploit or active exploitation.