Adobe Acrobat Pro DC Vulnerable to RCE via JPEG Parsing Integer Overflow
A critical integer overflow vulnerability in Adobe Acrobat Pro DC's JPEG parsing component allows remote code execution, requiring user interaction with a malicious file or webpage.
Zero Day Initiative (ZDI) has disclosed a critical remote code execution vulnerability affecting Adobe Acrobat Pro DC. The flaw, identified as ZDI-26-658 and assigned CVE-2026-81987, stems from an integer overflow within the software's JPEG parsing capabilities.
This vulnerability requires user interaction to be exploited. Attackers can trick victims into opening a specially crafted PDF file containing malicious JPEG data or by directing them to a compromised webpage that embeds such a file. Once a user interacts with the malicious content, the integer overflow can occur before a buffer is properly allocated, leading to a crash or, more critically, arbitrary code execution.
The specific technical weakness lies in the inadequate validation of user-supplied data during the JPEG parsing process. This lack of proper checks allows an attacker to manipulate the data in a way that triggers the integer overflow, potentially overwriting memory and gaining control of the program's execution flow. The vulnerability is rated with a CVSS score of 7.8, indicating a high severity.
Adobe has acknowledged the vulnerability and has released security updates to address it. Customers are strongly advised to update their Adobe Acrobat Pro DC installations to the latest version to mitigate the risk of exploitation. The advisory from Adobe, APSB26-141, provides further details on the affected versions and the patches available.
This disclosure follows a coordinated public release on September 10, 2026, after the vulnerability was initially reported to Adobe on June 10, 2026. The Zero Day Initiative, along with researcher Brandon Evans of TrendAI, has been credited with discovering and reporting this flaw.
The exploitation of PDF parsing components for remote code execution is a recurring theme in cybersecurity. Attackers frequently target these complex parsing engines, which handle a wide variety of embedded content types, to find vulnerabilities that can lead to system compromise. This particular flaw highlights the ongoing need for rigorous security testing and prompt patching of widely used document processing software.
Users of Adobe Acrobat Pro DC should remain vigilant against phishing attempts or suspicious links that could lead to the download or viewing of malicious PDF files. Applying security updates promptly remains the most effective defense against such threats, ensuring that the software's defenses are robust against known exploits.
This new advisory from Zero Day Initiative details a use-after-free vulnerability in Adobe Acrobat Pro DC, distinct from the JPEG parsing integer overflow previously reported. The vulnerability, tracked as CVE-2026-81988, also allows for remote code execution but stems from improper handling of Doc objects, specifically the lack of validation before object operations. While both require user interaction, this new flaw presents a different attack vector within the software's core functionality.