CVE-2026-81989

Adobe Acrobat Reader is affected by a use-after-free (CWE-416) memory-corruption bug that can be leveraged for arbitrary code execution in the context of the current user. The flaw is triggered only with user interaction: the victim must open a malicious file, most plausibly a crafted PDF, making this a client-side, socially engineered attack rather than a remote, server-side one. A successful exploit lets an attacker run code with the victim's privileges, enabling data theft, malware installation, or further movement within the environment. Anyone running the affected Acrobat Reader releases is exposed, though the source data does not enumerate specific version ranges. There is currently no sign of active exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only about a 0.2% probability of exploitation within 30 days (10th percentile).

What to do: Apply the fix as soon as Adobe's advisory for CVE-2026-81989 identifies it, prioritizing endpoints that routinely open PDFs from untrusted sources; consult the Adobe bulletin for the exact patched versions. In the interim, attachment sandboxing, mail filtering, and user caution with unsolicited PDFs reduce practical risk because exploitation requires opening a malicious file. Since there is no public PoC and no KEV listing, this can be handled through the normal patch cycle rather than as an emergency.