Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47913) Threatens Enterprise PDFs
What It Is – A use‑after‑free flaw in the handling of Rendition objects allows remote attackers to execute arbitrary code on systems running Adobe Acrobat Reader DC. The vulnerability (CVE‑2026‑47913) receives a CVSS 7.8 (High) rating.
Exploitability – Exploits require user interaction: the victim must open a malicious PDF or visit a crafted web page that triggers the Rendition processing. Proof‑of‑concept code has been released publicly, and an update fixing the issue is already available from Adobe.
Affected Products – Adobe Acrobat Reader DC (all supported versions prior to the June 2026 security update).
TPRM Impact – Organizations that rely on Adobe Acrobat Reader DC as a standard document viewer expose their employees, contractors, and downstream partners to remote code execution risk. Compromised endpoints can be leveraged to pivot into internal networks, exfiltrate data, or deploy ransomware, creating a supply‑chain threat vector.
Recommended Actions –
- Deploy Adobe’s security update (APS‑B26‑63) immediately across all endpoints.
- Enforce application control policies that block execution of unsigned PDF‑related binaries.
- Conduct a rapid inventory of all systems with Acrobat Reader DC installed and verify patch compliance.
- Update security awareness training to warn users against opening unsolicited PDFs or clicking links to unknown documents.
- Review third‑party contracts that mandate the use of Acrobat Reader DC and ensure vendors have applied the patch.