ZDI-26-671: Adobe Acrobat Reader DC Dialog Object Type Confusion Remote Code Execution Vulnerability
ZDI disclosed a type confusion RCE (CVE-2026-80161, CVSS 7.8) in Adobe Acrobat Reader DC requiring user interaction to exploit.
The Zero Day Initiative published advisory ZDI-26-671 for a Dialog Object type confusion vulnerability in Adobe Acrobat Reader DC. The flaw allows remote attackers to execute arbitrary code when a user opens a malicious file or visits a malicious page. ZDI rated the issue 7.8 on the CVSS scale and assigned CVE-2026-80161. The advisory does not report active exploitation.
- Type confusion in the Dialog object enables arbitrary code execution in Acrobat Reader DC
- Exploitation requires the target to open a malicious file or visit a malicious page
- ZDI assigned CVSS 7.8 and CVE-2026-80161
- CVEs
- CVE-2026-80161
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Acrobat Reader DC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80161 | Type Confusion Vulnerability in Adobe Acrobat Reader Allows Arbitrary Code Execution | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.