High severity · published Mar 10, 2026
CVE-2026-27220
Acrobat Reader | Use After Free (CWE-416)
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
Acrobat 2024 · Adobe
through 24.001.30307 (Win), 24.001.30308 (Mac) · source: vendor
AD
Acrobat DC · Adobe
through 25.001.21265 · source: vendor, NVD
AR
Acrobat Reader DC · Adobe
through 25.001.21265 · source: vendor, NVD
AC
Acrobat · Adobe
24.001.20604 before 24.001.30356 · source: NVD
In the news
VulnerabilityHigh
ZDI-26-355: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-27220.
Jun 10, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27220
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27220
Vendor Advisory
https://helpx.adobe.com/security/products/acrobat/apsb26-26.html
More from Acrobat 2024
8.6
CVE-2026-34621
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
8.8
CVE-2026-81996
Acrobat Reader | Incorrect Authorization (CWE-863)
8.6
CVE-2026-34622
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
7.8
CVE-2026-81989
Acrobat Reader | Use After Free (CWE-416)
7.8
CVE-2026-81980
Acrobat Reader | Out-of-bounds Write (CWE-787)