Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47918) Threatens Document Workflows

Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47918) Threatens Document Workflows

What It Is – A use‑after‑free flaw in the handling of Annotation objects allows remote attackers to execute arbitrary code on systems running Adobe Acrobat Reader DC. The vulnerability (CVE‑2026‑47918) scores 7.8 (CVSS 3.1) and requires the victim to open a malicious PDF or visit a crafted web page.

Exploitability – Public proof‑of‑concept code has been released and the vulnerability is actively being weaponised in the wild. Exploits require user interaction but no additional privileges.

Affected Products – Adobe Acrobat Reader DC (all supported versions prior to the June 2026 security update).

TPRM Impact –

• A compromised PDF can serve as a delivery vector for malware that infiltrates downstream vendors, partners, and customers.
• Organizations that embed Acrobat Reader in internal workflows (e.g., document management, e‑signatures) face elevated risk of supply‑chain compromise and data exfiltration.

Recommended Actions –

1. Deploy Adobe’s June 2026 security update (APS‑B26‑63) to all endpoints immediately.
2. Enforce application‑allow‑list policies that block outdated versions of Acrobat Reader.
3. Harden PDF handling: disable JavaScript in Acrobat, restrict opening of files from untrusted sources, and employ sandboxing solutions.
4. Review third‑party contracts for clauses requiring timely patching of critical components.
5. Monitor endpoint telemetry for anomalous process injection or unexpected child processes spawned by Acrobat.

Source: Zero Day Initiative Advisory ZDI‑26‑353