Adobe Acrobat Reader DC Annotation Use‑After‑Free (CVE‑2026‑47924) Enables Information Disclosure

Adobe Acrobat Reader DC Annotation Use‑After‑Free Information Disclosure (CVE‑2026‑47924) – Low‑Impact Data Leak

What It Is – A use‑after‑free flaw in the handling of Annotation objects within Adobe Acrobat Reader DC can allow a remote attacker to read memory contents of the process. The vulnerability does not lead to direct code execution, but it can expose snippets of potentially sensitive data.

Exploitability – Exploitation requires user interaction: the victim must open a malicious PDF or visit a crafted web page that triggers the vulnerable code path. No public exploit code is known, and the CVSS 3.3 base score reflects a low‑severity impact (Confidentiality Low, Integrity None, Availability None).

Affected Products – Adobe Acrobat Reader DC (all supported versions prior to the 2026‑06‑09 security update).

TPRM Impact – Organizations that rely on Adobe Reader as a standard PDF viewer across employees, contractors, or partners may inadvertently expose internal documents or metadata if a malicious file is opened. The flaw can be leveraged as a stepping‑stone in a broader supply‑chain attack, especially when combined with other client‑side exploits.

Recommended Actions –

1. Deploy Adobe’s security update (APS‑B‑26‑63) immediately on all endpoints.
2. Enforce strict PDF handling policies: block execution of untrusted PDFs from email or web downloads via endpoint security solutions.
3. Conduct a rapid inventory of all systems running Acrobat Reader DC and verify patch status.
4. Include the vulnerability in third‑party risk assessments for vendors that embed Adobe Reader in their products or services.

Source: Zero Day Initiative Advisory – ZDI‑26‑346