CVE-2026-81992

Adobe Acrobat Reader contains a heap-based buffer overflow (CWE-122) that can lead to arbitrary code execution in the context of the current user. The flaw is triggered locally: a victim must open a malicious file, typically a crafted PDF, so an attacker cannot exploit it without user interaction. Successful exploitation gives the attacker code execution with the victim's privileges, which in enterprise environments can be a foothold for lateral movement and data theft. Anyone running an affected Acrobat Reader build is exposed; the available data does not specify affected version ranges, so users should consult Adobe's security bulletin for exact versions and fixed releases. Exploitation status is currently calm: no public proof-of-concept, no listing in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade Acrobat/Reader to the fixed release identified in Adobe's security bulletin for CVE-2026-81992, and verify that auto-update is enabled across endpoints. Until patched, instruct users not to open PDFs from untrusted sources, since opening a malicious file is the required trigger. With no known in-the-wild exploitation or public PoC, treat this as a high-priority routine patch rather than an emergency.