Adobe Acrobat Reader: 18 Vulnerabilities Including Code Execution Flaws Disclosed Together
Adobe Acrobat Reader users urged to update following the September 8, 2026, disclosure of 18 vulnerabilities, including critical flaws allowing code execution.
Key findings
- Adobe Acrobat Reader patched 18 CVEs on September 8, 2026, including multiple high-severity flaws.
- Flaws include Use After Free, Heap Overflow, and Type Confusion, potentially leading to code execution.
- Some vulnerabilities allow for security feature bypass and privilege escalation.
- Denial-of-service and information disclosure vulnerabilities were also addressed.
- All vulnerabilities require user interaction, typically opening a malicious file.
On September 8, 2026, Adobe released a significant security update addressing 18 vulnerabilities in Adobe Acrobat Reader. The batch of Common Vulnerabilities and Exposures (CVEs) includes several high-severity flaws, primarily related to memory corruption and authorization issues, which could lead to arbitrary code execution or security feature bypasses. The vulnerabilities require user interaction, typically by opening a specially crafted PDF file, to be exploited.
The disclosed vulnerabilities span several categories:
- Arbitrary Code Execution: A majority of the high-severity flaws fall into this category. These include multiple Use After Free vulnerabilities (CVE-2026-81988, CVE-2026-81985, CVE-2026-81973, CVE-2026-79909), Heap-based Buffer Overflow (CVE-2026-81992), Integer Overflow or Wraparound (CVE-2026-81987), Out-of-bounds Write (CVE-2026-81983, CVE-2026-81980, CVE-2026-81979), Access of Resource Using Incompatible Type ('Type Confusion') (CVE-2026-80161), and Double Free (CVE-2026-79907). Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of the current user.
- Security Feature Bypass: CVE-2026-81997, an Incorrect Authorization vulnerability, could allow an attacker to bypass security measures and gain unauthorized write access. Another Incorrect Authorization vulnerability, CVE-2026-81996, could lead to privilege escalation for a low-privileged attacker.
- Information Disclosure: Several vulnerabilities could lead to the disclosure of sensitive memory or information. These include Heap-based Buffer Overflow (CVE-2026-81993), Out-of-bounds Read (CVE-2026-81991), Use After Free (CVE-2026-81984), and Integer Underflow (Wrap or Wraparound) (CVE-2026-81977).
- Denial-of-Service: CVE-2026-82001 is an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service by exhausting system resources.
While Adobe has not indicated any active exploitation of these vulnerabilities in the wild, the severity and number of flaws underscore the importance of prompt patching. Users are advised to update their Adobe Acrobat Reader installations to the latest version to mitigate these risks. The specific versions affected and patched are detailed in Adobe's security advisory.
This coordinated disclosure highlights the ongoing efforts to identify and address security weaknesses in widely used software. Users should remain vigilant and apply security updates as soon as they become available to protect against potential attacks. The focus on memory corruption vulnerabilities is a common theme in software security, emphasizing the need for robust memory management practices in software development.