Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑47919) Threatens Enterprise Document Workflows
What It Is — A use‑after‑free flaw in the handling of Annotation objects allows remote attackers to execute arbitrary code on systems running Adobe Acrobat Reader DC. The vulnerability (CVE‑2026‑47919) scores 7.8 (CVSS 3.1) and requires user interaction (opening a malicious PDF or visiting a crafted web page).
Exploitability — Public advisory released 9 June 2026; proof‑of‑concept code has been shared in the security community. No known active ransomware‑as‑a‑service exploiting it yet, but the low‑complexity exploit path makes it attractive for opportunistic actors.
Affected Products — Adobe Acrobat Reader DC (all supported versions prior to the 2026‑06‑09 security update).
TPRM Impact — Organizations that embed Acrobat Reader in internal portals, document‑management systems, or provide it to employees as a standard tool inherit a direct attack surface. A compromised reader can execute malicious payloads in the context of the logged‑in user, potentially leading to credential theft, data exfiltration, or lateral movement within the supply chain.
Recommended Actions —
- Deploy Adobe’s security update (APSB26‑63) immediately across all endpoints.
- Enforce application‑whitelisting or restrict execution of Acrobat Reader to vetted file sources.
- Conduct a rapid inventory of all systems and third‑party services that rely on Acrobat Reader for PDF handling.
- Apply macro‑blocking and URL‑filtering policies to mitigate malicious PDF delivery.
- Update incident‑response playbooks to include “malicious PDF” scenarios.