ZDI-26-673: Adobe Acrobat Pro DC Doc Object Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-81988, a use-after-free in Adobe Acrobat Pro DC document object handling that enables remote code execution.
Zero Day Initiative advisory ZDI-26-673 describes a use-after-free vulnerability in the document object handling of Adobe Acrobat Pro DC. Arbitrary code execution is possible when a target opens a malicious file or visits a malicious page. The flaw received a CVSS rating of 7.8. No in-the-wild exploitation is reported.
- CVE-2026-81988 assigned; CVSS 7.8
- Use-after-free in Acrobat Pro DC document objects
- User interaction required; no exploitation reported
- CVEs
- CVE-2026-81988
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Acrobat Pro DC
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81988 | Use-After-Free in Adobe Acrobat Reader Enables Arbitrary Code Execution | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.