Adobe Acrobat Reader DC Vulnerable to Information Disclosure via JBIG2 Parsing Flaw
A critical information disclosure vulnerability in Adobe Acrobat Reader DC's JBIG2 file parsing allows remote attackers to expose sensitive data with user interaction.
Zero Day Initiative (ZDI) has disclosed a significant information disclosure vulnerability affecting Adobe Acrobat Reader DC. The flaw, tracked as ZDI-26-669 and assigned CVE-2026-81978, resides within the software's handling of JBIG2-encoded image streams.
Successful exploitation of this vulnerability requires a user to interact with a malicious element, such as opening a specially crafted file or visiting a compromised webpage. Once triggered, the vulnerability allows remote attackers to read data beyond the boundaries of an allocated buffer. While this specific vulnerability is categorized as an out-of-bounds read leading to information disclosure, the ZDI advisory notes that it could potentially be chained with other vulnerabilities to achieve arbitrary code execution.
The CVSS score for this vulnerability is rated at 3.3, indicating a low severity for direct exploitation but highlighting the potential for attackers to gather sensitive information that could aid in further attacks. The vulnerability was reported to Adobe on June 30, 2026, and ZDI coordinated its public release on September 10, 2026, with an advisory update on the same day.
Adobe has already released a security update to address this issue. Customers are advised to consult Adobe's security bulletin APSB26-141 for detailed information on the patch and affected versions. Prompt application of this update is crucial to mitigate the risk of sensitive information disclosure.
This vulnerability underscores the ongoing challenges in securing complex software like PDF readers, which often process a wide variety of file formats and encodings. The JBIG2 format, used for compressing black and white images, has been a source of vulnerabilities in the past, requiring careful parsing and validation to prevent memory corruption and information leaks.
The disclosure timeline, from initial vendor reporting to public release, follows a standard coordinated disclosure process, allowing Adobe sufficient time to develop and distribute a fix. The vulnerability was discovered by NURIHAN KIM (HanTul), who is credited in the ZDI advisory.
Users of Adobe Acrobat Reader DC should ensure their software is updated to the latest version to protect against this and other potential security threats. The information disclosed could include sensitive data present in memory, which attackers could leverage for targeted attacks or to gain further insight into the victim's system or network environment.
This incident serves as a reminder for organizations and individuals to maintain vigilance regarding software updates, especially for widely used applications that handle diverse file types. The potential for information disclosure, even with a low CVSS score, can have significant implications for data privacy and security.
This new advisory, ZDI-26-672, details an integer underflow vulnerability in Adobe Acrobat Reader DC's PDF file parsing, leading to information disclosure. While the previous story focused on a JBIG2 parsing flaw, this advisory specifically addresses an integer underflow that can be chained with other vulnerabilities for potential code execution, albeit with a lower CVSS score of 3.3.