ZDI-26-663: Adobe Acrobat Pro DC Annotation Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-81989, a use-after-free remote code execution flaw in Adobe Acrobat Pro DC annotation handling rated CVSS 7.8.
The Zero Day Initiative published advisory ZDI-26-663 for a use-after-free vulnerability in Adobe Acrobat Pro DC's annotation processing. Successful exploitation allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw is rated CVSS 7.8 and is tracked as CVE-2026-81989.
- Use-after-free in Acrobat Pro DC annotation handling allows arbitrary remote code execution.
- Exploitation requires the target to open a malicious file or visit a malicious page.
- No exploitation in the wild is reported in the advisory.
- CVEs
- CVE-2026-81989
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Acrobat Pro DC
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81989 | Use-After-Free Arbitrary Code Execution in Adobe Acrobat Reader | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.