Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47912) Threatens PDF Users

Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47912) Threatens PDF Users

What It Is – A use‑after‑free flaw in the font‑handling code of Adobe Acrobat Reader DC allows an attacker to execute arbitrary code in the context of the victim’s process. The vulnerability is tracked as CVE‑2026‑47912.

Exploitability – Exploits require the victim to open a malicious PDF or visit a crafted web page, but no additional privileges are needed. A proof‑of‑concept has been released publicly; the CVSS base score is 7.8 (High).

Affected Products – Adobe Acrobat Reader DC (all versions prior to the June 2026 security update).

TPRM Impact –

• Any downstream organization that mandates Adobe Reader for contract signing, invoicing, or internal documentation inherits a remote‑code‑execution risk.
• Compromise of a single workstation can lead to lateral movement within a vendor’s network, exposing confidential data of multiple clients.

Recommended Actions –

1. Deploy Adobe’s security update (APS‑B26‑63) immediately across all endpoints.
2. Enforce application‑allow‑list policies that block execution of unapproved PDF viewers.
3. Conduct a rapid inventory of all systems that still run vulnerable Reader versions and remediate.
4. Review third‑party contracts that require the use of Adobe Reader and consider alternative, hardened PDF solutions.
5. Monitor for anomalous process activity linked to AcroRd32.exe and implement EDR alerts for code‑execution patterns.

Source: Zero Day Initiative Advisory ZDI‑26‑345