ZDI-26-664: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-81986, a use-after-free remote code execution flaw in Adobe Acrobat Reader DC annotation handling rated CVSS 7.8.
The Zero Day Initiative published advisory ZDI-26-664 for a use-after-free vulnerability in Adobe Acrobat Reader DC's annotation processing. Successful exploitation allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw is rated CVSS 7.8 and is tracked as CVE-2026-81986.
- Use-after-free in Acrobat Reader DC annotation handling allows arbitrary remote code execution.
- Exploitation requires the target to open a malicious file or visit a malicious page.
- No exploitation in the wild is reported in the advisory.
- CVEs
- CVE-2026-81986
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Acrobat Reader DC
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81986 | Use-After-Free in Adobe Acrobat Reader Enables Code Execution via Malicious File | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.