SB2026090862 - Multiple vulnerabilities in Adobe Acrobat and Reader

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090862

SB2026090862 - Multiple vulnerabilities in Adobe Acrobat and Reader

Published: September 8, 2026

Security Bulletin ID SB2026090862
CSH Severity
High
Patch available
YES
Number of vulnerabilities 32
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 56% Medium 38% Low 6%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 32 vulnerabilities.


1) Integer overflow (CVE-ID: CVE-2026-81987)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


2) Use-after-free (CVE-ID: CVE-2026-81985)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


3) Out-of-bounds write (CVE-ID: CVE-2026-81981)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


4) Out-of-bounds write (CVE-ID: CVE-2026-81980)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


5) Out-of-bounds write (CVE-ID: CVE-2026-81979)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


6) Heap-based buffer overflow (CVE-ID: CVE-2026-81992)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


7) Use-after-free (CVE-ID: CVE-2026-81976)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


8) Use-after-free (CVE-ID: CVE-2026-81986)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


9) Use-after-free (CVE-ID: CVE-2026-81975)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


10) Type Confusion (CVE-ID: CVE-2026-80161)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to type confusion in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


11) Use-after-free (CVE-ID: CVE-2026-79909)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


12) Out-of-bounds write (CVE-ID: CVE-2026-79908)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


13) Double free (CVE-ID: CVE-2026-79907)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a double free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


14) Out-of-bounds write (CVE-ID: CVE-2026-81983)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


15) Prototype pollution (CVE-ID: CVE-2026-81994)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read arbitrary files.

The vulnerability exists due to improperly controlled modification of object prototype attributes in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to read arbitrary files.


16) Use-after-free (CVE-ID: CVE-2026-81973)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


17) Use-after-free (CVE-ID: CVE-2026-81989)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


18) Incorrect authorization (CVE-ID: CVE-2026-81996)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to incorrect authorization in Adobe Acrobat and Reader when using the application. A local user can trigger the vulnerability to escalate privileges.


19) Use-after-free (CVE-ID: CVE-2026-81990)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


20) Incorrect authorization (CVE-ID: CVE-2026-81997)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write arbitrary files.

The vulnerability exists due to incorrect authorization in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to write arbitrary files.


21) Out-of-bounds read (CVE-ID: CVE-2026-81982)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to an out-of-bounds read in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


22) Resource exhaustion (CVE-ID: CVE-2026-82001)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.


23) Out-of-bounds read (CVE-ID: CVE-2026-80160)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to an out-of-bounds read in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


24) Use-after-free (CVE-ID: CVE-2026-80162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


25) Integer underflow (CVE-ID: CVE-2026-81977)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to integer underflow in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


26) Out-of-bounds read (CVE-ID: CVE-2026-81978)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to an out-of-bounds read in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


27) Heap-based buffer overflow (CVE-ID: CVE-2026-81993)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to a heap-based buffer overflow in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


28) Use-after-free (CVE-ID: CVE-2026-81984)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


29) Out-of-bounds read (CVE-ID: CVE-2026-81991)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to an out-of-bounds read in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


30) Out-of-bounds read (CVE-ID: CVE-2026-79910)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents.

The vulnerability exists due to an out-of-bounds read in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to disclose memory contents.


31) Untrusted search path (CVE-ID: CVE-2026-80159)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to an untrusted search path in Adobe Acrobat and Reader when processing a crafted file. A local privileged user can trick the victim into opening a crafted file to escalate privileges.


32) Use-after-free (CVE-ID: CVE-2026-81988)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in Adobe Acrobat and Reader when processing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.


Remediation

Install update from vendor's website.

References