CVE-2026-81984

Adobe Acrobat Reader contains a use-after-free vulnerability (CWE-416) in its annotation processing, tracked as ZDI-26-668, that can leak sensitive memory contents. An attacker triggers the flaw by crafting a malicious PDF file and persuading a victim to open it, since exploitation requires local user interaction. Successful exploitation discloses sensitive information from memory, though it does not allow code execution or file modification. All users of Adobe Acrobat Reader who open untrusted PDF files are potentially affected, with the reader's enormous installed base making broad exposure likely. As of now there is no known public proof-of-concept, the vulnerability is not in CISA's Known Exploited Vulnerabilities catalog, and the EPSS score of 0.2% indicates low expected near-term exploitation.

What to do: Update Acrobat Reader to the latest release available from Adobe's security bulletin (specific patched versions are not listed in the available data, so verify against the official Adobe advisory for CVE-2026-81984). Until patched, avoid opening PDF files from untrusted or unverified sources and consider configuring Reader for Protected Mode/Protected View. Check deployed Reader versions across endpoints and prioritize patching users who regularly handle PDF attachments from external parties.