CVE-2026-81981

CVE-2026-81981 is an out-of-bounds write vulnerability (CWE-787) in Adobe Acrobat Reader that can allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. It is triggered by user interaction: the victim must open a maliciously crafted PDF file, typically delivered via phishing or another social-engineering channel. An attacker who succeeds gains code execution in the user's context, with high impact on confidentiality, integrity, and availability, though not elevated (admin) privileges. Anyone running an affected build of Acrobat Reader is exposed; the source data does not specify affected version ranges. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS is low at 0.2% (6th percentile), so no exploitation is known at this time.

What to do: Update Acrobat Reader to the latest patched release per Adobe's security advisory (fixed build numbers are not included in this data), and verify installed versions on endpoints to prioritize patching. Until systems are patched, keep Protected Mode/Protected View sandboxing enabled and warn users not to open unsolicited or unexpected PDF attachments, since exploitation requires the victim to open a malicious file. No public PoC or confirmed in-the-wild exploitation is known, and the 30-day exploitation probability (EPSS) is low at 0.2%, but patching should still be treated as routine-high priority given the product's ubiquity.