Critical Use‑After‑Free RCE in Adobe Acrobat Pro DC (CVE‑2026‑47917) Threatens Document Workflows

Critical Use‑After‑Free RCE in Adobe Acrobat Pro DC (CVE‑2026‑47917) Threatens Document Workflows

What It Is – A use‑after‑free flaw in the AcroForm handling code of Adobe Acrobat Pro DC allows a remote attacker to execute arbitrary code in the context of the Acrobat process. The vulnerability (CVE‑2026‑47917) scores 7.8 (CVSS 3.1) and requires the victim to open a malicious PDF or visit a crafted web page.

Exploitability – No public exploit has been released, but a proof‑of‑concept exists and the vulnerability is actively being weaponised in targeted phishing campaigns. The low‑complexity (AV:L) and required user interaction (UI:R) make it attractive for spear‑phishing.

Affected Products – Adobe Acrobat Pro DC (all versions prior to the 2026‑06‑09 security update).

TPRM Impact – Organizations that embed Acrobat in document‑centric workflows (e.g., legal, finance, healthcare, SaaS platforms) face a supply‑chain risk: a compromised PDF could execute code on any workstation, potentially exfiltrating confidential data or installing ransomware.

Recommended Actions –

1. Deploy Adobe’s security update APS‑B26‑63 immediately.
2. Enforce strict PDF handling policies: block AcroForm features, disable JavaScript in PDFs, and restrict execution of unsigned PDFs.
3. Deploy endpoint protection with behavior‑based detection for anomalous Acrobat activity.
4. Conduct user awareness training on malicious PDF phishing.
5. Verify third‑party vendors that embed Acrobat in their services have applied the patch.

Source: Zero Day Initiative Advisory ZDI‑26‑352