ZDI-26-665: Adobe Acrobat Reader DC Annots Report Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-79909, a use-after-free remote code execution flaw in Adobe Acrobat Reader DC rated CVSS 7.8, requiring user interaction.
The Zero Day Initiative published advisory ZDI-26-665 for a use-after-free vulnerability in Adobe Acrobat Reader DC's Annots processing. Successful exploitation allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw is rated CVSS 7.8 and is tracked as CVE-2026-79909.
- Use-after-free in Acrobat Reader DC annotation handling allows arbitrary remote code execution.
- Exploitation requires the target to open a malicious file or visit a malicious page.
- No exploitation in the wild is reported in the advisory.
- CVEs
- CVE-2026-79909
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Acrobat Reader DC
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79909 | Use-After-Free Code Execution Flaw in Adobe Acrobat Reader | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.