Critical Use‑After‑Free RCE in Adobe Acrobat Pro DC (CVE‑2026‑47915) Threatens Document Workflows

Critical Use‑After‑Free RCE in Adobe Acrobat Pro DC (CVE‑2026‑47915) Threatens Document Workflows

What It Is – A use‑after‑free flaw in the Annots.api component of Adobe Acrobat Pro DC allows remote attackers to execute arbitrary code. The vulnerability is triggered via malicious JavaScript embedded in a PDF or a crafted web page that forces the PDF viewer to process annotation objects.

Exploitability – CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Public proof‑of‑concept code has been released, and the exploit requires only user interaction (opening a malicious PDF or visiting a malicious page).

Affected Products – Adobe Acrobat Pro DC (all versions prior to the 2026‑06 security update).

TPRM Impact – Vendors that embed, process, or transmit PDFs using Acrobat Pro DC may inadvertently become a conduit for ransomware, data exfiltration, or supply‑chain compromise. Compromised PDFs can spread to downstream customers, amplifying risk across multiple industries.

Recommended Actions –

1. Deploy Adobe’s security update (APSB26‑63) immediately.
2. Disable JavaScript execution in PDF readers where not required.
3. Enforce strict content‑filtering on inbound PDFs and scan for malicious scripts.
4. Update endpoint detection and response (EDR) signatures to detect known exploit patterns.
5. Review third‑party contracts for PDF handling clauses and require vendors to adopt the same mitigations.

Source: Zero Day Initiative Advisory ZDI‑26‑349