CVE-2026-82001: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2026-82001 is an Uncontrolled Resource Consumption (CWE-400) vulnerability in Adobe Acrobat and Acrobat Reader that can lead to an application-level denial-of-service condition. Affected products include Adobe Acrobat DC and Acrobat Reader DC (versions 15.008.20082 through 26.002.21900) and Acrobat 2024 (versions up to 24.001.30383) on Windows and macOS. The vulnerability was disclosed and patched on September 8, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the application fails to properly limit the allocation or use of system resources when processing certain file inputs. An attacker can craft a malicious PDF or supported file type that, when opened by a victim in Acrobat Reader or Acrobat, triggers excessive resource consumption — exhausting CPU, memory, or other system resources. Exploitation requires local user interaction (the victim must open the malicious file), and no elevated privileges are needed on the attacker's part. No public proof-of-concept or detailed technical write-up has been identified at this time (Adobe Advisory, GitHub Advisory).

Successful exploitation results in an application denial-of-service, causing Adobe Acrobat or Acrobat Reader to become unresponsive or crash due to resource exhaustion. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. The scope is unchanged, meaning the impact is confined to the affected application and does not extend to the broader system or other components (Adobe Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of disclosure. The EPSS score is approximately 0.155%, indicating a low probability of exploitation within 30 days. The vulnerability is rated as non-automatable by SSVC analysis, as it requires user interaction to open a malicious file. It does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Adobe Advisory, GitHub Advisory).

1. Craft a malicious file: Create a specially crafted PDF or supported document designed to trigger uncontrolled resource consumption when parsed by Adobe Acrobat or Acrobat Reader (e.g., through deeply nested structures, recursive references, or excessively large data fields).
2. Deliver the file to the victim: Use social engineering techniques such as phishing emails, malicious downloads, or shared network drives to deliver the crafted file to a target user.
3. Induce the victim to open the file: The victim must open the malicious file using a vulnerable version of Adobe Acrobat or Acrobat Reader (≤26.002.21900 for Continuous track, or ≤24.001.30383 for Acrobat 2024).
4. Trigger resource exhaustion: Upon opening, the application processes the malicious content and enters a resource-intensive loop or allocates excessive memory/CPU, causing the application to hang or crash.
5. Achieve denial-of-service: The application becomes unavailable to the user, potentially disrupting workflows dependent on Acrobat (Adobe Advisory).

• Process Behavior: Adobe Acrobat or Acrobat Reader process (AcroRd32.exe, Acrobat.exe) consuming abnormally high CPU or memory resources after opening a specific file.
• Application Logs: Application crash reports or Windows Event Log entries (Event ID 1000/1001) referencing Acrobat processes terminating unexpectedly.
• File System: Presence of unexpected or unsolicited PDF/document files in user download directories, email attachments, or shared drives that trigger application instability upon opening.
• Network: Unusual inbound file transfers (e.g., email attachments or downloads) of PDF files from unknown or untrusted sources preceding application crashes.

Adobe has released patched versions addressing this vulnerability: Acrobat DC and Acrobat Reader DC should be updated to version 26.002.21901 or later, and Acrobat 2024 should be updated to version 24.001.30429 or later. Users should apply updates via Adobe's built-in update mechanism or through enterprise deployment tools. As a precautionary measure, users should avoid opening PDF files from untrusted or unknown sources, and administrators may consider implementing application control policies and monitoring for abnormal resource consumption by Acrobat processes (Adobe Advisory).

The CIS (Center for Internet Security) published an advisory noting multiple vulnerabilities in Adobe products patched in September 2026, including this CVE, as part of a broader security update cycle. Coverage was also picked up by automated vulnerability tracking services such as BeyondMachines, VulDB, and CVEFeed. No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE, consistent with its medium severity and lack of active exploitation (Adobe Advisory).