ZDI-26-662: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
ZDI discloses CVE-2026-81990, a use-after-free in Adobe Acrobat Reader DC annotation handling allowing remote code execution with CVSS 7.8.
The Zero Day Initiative published ZDI-26-662 covering a use-after-free vulnerability in Adobe Acrobat Reader DC's annotation feature. Successful exploitation allows arbitrary code execution but requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI assigned a CVSS score of 7.8 and tracked the flaw as CVE-2026-81990.
- Use-after-free in annotation handling enables remote code execution in Acrobat Reader DC
- Exploitation requires user interaction, such as opening a malicious file or page
- Rated CVSS 7.8 and tracked as CVE-2026-81990
- CVEs
- CVE-2026-81990
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Acrobat Reader DC
- Organizations
- AdobeZero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81990 | Use-After-Free Code Execution Flaw in Adobe Acrobat Reader | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.