Adobe Acrobat Reader DC Vulnerable to Information Disclosure via JPEG2000 Parsing Flaw
A new vulnerability in Adobe Acrobat Reader DC allows remote attackers to disclose sensitive information by exploiting a flaw in JPEG2000 file parsing.
Adobe Acrobat Reader DC is susceptible to an information disclosure vulnerability stemming from an out-of-bounds read within its JPEG2000 file parsing component. This flaw, identified as ZDI-26-666 and tracked under CVE-2026-79910, allows remote attackers to potentially reveal sensitive data on affected systems.
The vulnerability requires user interaction for exploitation, meaning an attacker must trick a user into visiting a malicious webpage or opening a specially crafted file. Once triggered, the vulnerability allows an attacker to read data beyond the boundaries of an allocated buffer. While this specific vulnerability is rated with a low CVSS score of 3.3 and primarily leads to information disclosure, the Zero Day Initiative (ZDI) notes that it could be chained with other vulnerabilities to achieve arbitrary code execution.
The root cause of the vulnerability lies in the insufficient validation of user-supplied data during the parsing of JPEG2000 formatted images. Attackers can leverage this weakness to gain unauthorized access to memory regions, potentially exposing confidential information.
Adobe has addressed this vulnerability by releasing a security update. Users are strongly advised to update their Adobe Acrobat Reader DC installations to the latest version to mitigate the risk. Further details on the patch can be found in Adobe's security advisory APSB26-141.
The disclosure timeline indicates that the vulnerability was initially reported to Adobe on July 29, 2026. Following coordinated disclosure efforts, a public advisory was released on September 10, 2026, with an update to the advisory also published on the same day. The research leading to the discovery of this flaw is credited to Kiwan Ko.
This vulnerability adds to a growing list of security issues found in widely used PDF readers, highlighting the persistent challenges in securing complex file parsing mechanisms. Organizations and individuals relying on Adobe Acrobat Reader DC should prioritize applying security updates promptly to protect against potential information leakage and further exploitation attempts.
The successful exploitation of such vulnerabilities underscores the importance of robust security practices, including maintaining up-to-date software, employing endpoint security solutions, and educating users about the risks associated with opening untrusted files or visiting suspicious websites.
This advisory, ZDI-26-659, details a specific out-of-bounds read vulnerability within Adobe Acrobat Reader DC's JPEG2000 file parsing component, assigned CVE-2026-80160. While the existing story broadly covers an information disclosure flaw in JPEG2000 parsing, this new information provides the specific CVE identifier and confirms that the vulnerability allows remote attackers to disclose sensitive information, with a CVSS score of 3.3, requiring user interaction for exploitation.