CVE-2026-79909

Adobe Acrobat Reader contains a use-after-free vulnerability (CWE-416) that can lead to arbitrary code execution in the context of the currently logged-in user. The flaw is triggered locally when a victim opens a maliciously crafted PDF file, so the attack vector requires user interaction rather than network-reachable exploitation. A successful attacker gains the privileges of the user running Reader, which typically means access to that user's files and session on the workstation. All users of the affected Acrobat Reader builds are potentially exposed, as the data does not enumerate specific version ranges. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and its EPSS score of 0.2% (6th percentile) indicates a low near-term likelihood of exploitation in the wild.

What to do: Monitor Adobe's Security Bulletins (APSB advisories) for this CVE and apply the patched Reader build via Adobe's updater as soon as it is released, since the data does not yet list fixed versions. In the interim, warn users not to open PDF attachments or downloads from untrusted senders, as exploitation requires opening a malicious file. Verify deployed Reader versions across your estate using software inventory so you can prioritize patching once Adobe publishes the fixed releases.