Loading vulnerability…
Out-of-bounds read in Adobe Acrobat Reader Doc object handling
CVE-2026-47923 is an information disclosure vulnerability in Adobe Acrobat Reader affecting versions 24.001.30365, 26.001.21651, and earlier. The flaw is an out-of-bounds read in the handling of Doc objects caused by improper validation of user-supplied data, which can result in a read past the end of an allocated object and exposure of sensitive process memory. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page that triggers the vulnerable parsing path.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to disclose sensitive memory from the affected Acrobat Reader process. The primary impact is confidentiality loss rather than integrity or availability impact. Exposed memory may include data useful for further exploitation, and the vulnerability could potentially be chained with other flaws to facilitate arbitrary code execution in the context of the current process.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by preventing users from opening untrusted or unsolicited PDF documents and from visiting untrusted content that could invoke Acrobat Reader handling of malicious files. Use application control, email and web content filtering, and least-privilege user environments to limit exploitation opportunities. Because exploitation requires user interaction, user awareness and attachment-handling restrictions can materially reduce risk.
Patch, then assume compromise.
Apply the vendor-provided security update from Adobe that addresses CVE-2026-47923. Systems running Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier should be upgraded to a fixed release referenced by Adobe's June 2026 security bulletin for Acrobat and Reader.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.