Read the docs
TI-2026-56582 Aliases CVE-2026-81988GHSA-4xhp-7w2g-m837

Acrobat Reader | Use After Free (CWE-416)

Priority LOW 36CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed Adobe Acrobat (Adobe): 26.002.21901Acrobat Reader (Adobe): 26.002.21901+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe Acrobatup to 26.002.2190026.002.21901Patch availableCNA
AdobeAcrobat Readerup to 26.002.2190026.002.21901Patch availableCNA
AdobeAcrobat 2024up to 24.001.3038324.001.30429Patch availableCNA
  • Adobe Acrobat VendorAdobe Affected up to 26.002.21900 Fixed in 26.002.21901 Patch available CNA
  • Acrobat Reader VendorAdobe Affected up to 26.002.21900 Fixed in 26.002.21901 Patch available CNA
  • Acrobat 2024 VendorAdobe Affected up to 24.001.30383 Fixed in 24.001.30429 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*24.001.20604 to before 24.001.30429VulnerableAdobe
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*15.008.20082 to before 26.002.21901VulnerableAdobe
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*15.008.20082 to before 26.002.21901VulnerableAdobe
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* Versions 24.001.20604 to before 24.001.30429 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* Versions 15.008.20082 to before 26.002.21901 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* Versions 15.008.20082 to before 26.002.21901 Vulnerable ·Adobe
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Adobe Acrobat (Adobe) Fixed in 26.002.21901
  • Fix · CNA Acrobat Reader (Adobe) Fixed in 26.002.21901
  • Fix · CNA Acrobat 2024 (Adobe) Fixed in 24.001.30429

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe Acrobat 2024, Acrobat Reader, Adobe Acrobat — helpx.adobe.com/security/products/acrobat/apsb26-141.html

    32 records Highest priority Priority MEDIUM 1 MEDIUM, 31 LOW

    Other records, highest priority first

    • TI-2026-56590 Acrobat Reader | Incorrect Authorization (CWE-863)Priority MEDIUM 40
    • TI-2026-56588 Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)Priority LOW 39
    • TI-2026-56586 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)Priority LOW 36
    Show all 32 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81988
  2. 2026-10-03 Alias added: GHSA-4xhp-7w2g-m837

References

Advisory 1

  • TI-2014-00524 Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02915 Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02389 Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2011-02156 Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-09626 Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution KEVCVSS 3.1HIGH 8.8
  • TI-2021-04123 Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution KEVCVSS 3.1HIGH 8.8
See all 1413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences