Critical Adobe Acrobat Flaw Allows Memory Corruption via Crafted PDFs
Adobe has patched CVE-2026-81983, a critical vulnerability in Acrobat and Acrobat Reader that allows memory corruption and potential code execution through specially crafted PDF files.
Adobe has released a critical security update to address CVE-2026-81983, a vulnerability affecting its Acrobat and Acrobat Reader software. This flaw, rated with a CVSS score of 7.8, allows for memory corruption when a user opens a maliciously crafted PDF document. The vulnerability could potentially lead to arbitrary code execution with the privileges of the user opening the file, though Adobe has stated it has not observed any active exploitation in the wild.
The vulnerability resides within Acrobat's image pipeline, a component responsible for parsing image data as soon as a PDF file is opened. Security researchers discovered this bug using a custom Python fuzzer, which was significantly aided by a large language model. Instead of fuzzing entire PDF files, the tool focused on generating small, valid documents and systematically altering image-related fields such as width, height, bit depth, color space, filters, and sample bytes. The most impactful crash was triggered by a crafted 16-bit image within a PDF file as small as 745 bytes.
The root cause of the vulnerability is a 32-bit integer overflow within Acrobat.dll. The software calculates the number of image samples by multiplying the image's width by its color component count. A subsequent size check adds two bytes for every 16-bit sample. When an extremely large width value is used, this calculation can wrap around to a very small number in 32-bit arithmetic. This allows Acrobat to accept a data stream that is significantly shorter than what is actually required.
This discrepancy leads to a byte-swap loop that continues to read and write data beyond the boundaries of a 16-byte buffer, resulting in memory corruption. This corruption can provide an attacker with a pathway to execute arbitrary code on the victim's system. For instance, a proof-of-concept exploit utilized an image with a width of 536,870,912 and a height of one, with 16 bits per component and the DeviceCMYK color space. The four CMYK components resulted in a sample count of 0x80000000. The size check erroneously approved an eight-byte stream, which the subsequent loop then overran.
According to research from Remedio, the related byte-size calculation reached 0x100000000 and wrapped to zero due to the 32-bit math limitations. This allowed the malformed data stream to pass validation. Simply opening the malicious PDF was sufficient to trigger the faulty image-rendering path. The CVSS vector indicates a local attack path with low complexity, requiring no special privileges but necessitating user interaction (opening the file).
Adobe has addressed this critical flaw by implementing 64-bit math for sample count calculations and by introducing checks to reject values exceeding INT_MAX before memory operations occur. The fix was delivered in security bulletin APSB26-141 on September 8, 2026. Specifically, Acrobat and Acrobat Reader Continuous versions prior to 26.002.21900 were updated to 26.002.21901, and Acrobat 2024 Classic versions prior to 24.001.30383 were updated to 24.001.30429.
Users and system administrators are strongly advised to install these security updates immediately. Enabling automatic updates and exercising caution with unexpected PDF attachments are crucial preventative measures. Security teams should also consider implementing filters for suspicious PDFs at email gateways and monitoring for application crashes related to Acrobat.dll.
The discovery of CVE-2026-81983 highlights the effectiveness of focused, AI-assisted fuzzing techniques in uncovering deep-seated vulnerabilities within legacy file parsing components. This incident underscores the ongoing risks associated with PDF documents and the importance of timely patching for widely used software like Adobe Acrobat.