ZDI-26-660: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability
ZDI discloses CVE-2026-80162, a font-parsing use-after-free in Adobe Acrobat Reader DC enabling limited sensitive information disclosure with CVSS 3.3.
The Zero Day Initiative published ZDI-26-660 covering a use-after-free vulnerability in Adobe Acrobat Reader DC's font parsing. Successful exploitation allows disclosure of sensitive information and requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI rated the issue CVSS 3.3 and tracked it as CVE-2026-80162.
- Font-parsing use-after-free allows information disclosure in Acrobat Reader DC
- Requires user interaction, such as opening a crafted file
- Rated CVSS 3.3 and tracked as CVE-2026-80162
- CVEs
- CVE-2026-80162
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Acrobat Reader DC
- Organizations
- AdobeZero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80162 | Use-After-Free in Adobe Acrobat Reader Font Parsing Leaks Sensitive Memory | 5.5 | <1% |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.