Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47914) Threatens Document Workflows

Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47914) Threatens Document Workflows

What It Is – Adobe Acrobat Reader DC contains a use‑after‑free flaw in the handling of Annotation objects. An attacker who convinces a user to open a crafted PDF or visit a malicious web page can achieve remote code execution with the privileges of the current user.

Exploitability – The vulnerability is locally‑low (requires user interaction) but has a CVSS 7.8 rating, indicating high impact on confidentiality, integrity, and availability. No public exploit code has been released, but proof‑of‑concept (PoC) samples are circulating among security researchers.

Affected Products – Adobe Acrobat Reader DC (all supported versions prior to the June 2026 security update).

TPRM Impact – Many enterprises embed Acrobat Reader in internal workflows, SaaS portals, and document‑exchange platforms. A compromised reader can become a foothold for lateral movement, data exfiltration, or supply‑chain attacks against downstream partners.

Recommended Actions –

1. Deploy Adobe’s security update (APS B‑26‑63) immediately on all endpoints.
2. Enforce application‑control policies that block execution of untrusted PDFs from external sources.
3. Verify that PDF‑handling services in third‑party SaaS solutions are patched.
4. Conduct a rapid inventory of all systems running Acrobat Reader and prioritize remediation.
5. Review incident‑response playbooks for RCE scenarios involving document viewers.

Source: Zero Day Initiative Advisory – ZDI‑26‑348