Loading vulnerability…
Use-After-Free Information Disclosure in Adobe Acrobat Reader Annotation Handling
CVE-2026-47924 is a use-after-free vulnerability in Adobe Acrobat Reader affecting versions 24.001.30365, 26.001.21651, and earlier. The flaw exists in the handling of Annotation objects, where the application fails to properly validate that an object still exists before performing operations on it. This can result in dereferencing freed memory and exposing sensitive process memory contents. The issue is primarily an information disclosure vulnerability rather than a direct code execution flaw, although memory corruption of this type may be useful in exploit chains.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive memory from the Acrobat Reader process, potentially exposing confidential information present in process memory. The documented impact is information disclosure. The available reporting also indicates the flaw could be combined with other vulnerabilities to help achieve arbitrary code execution in the context of the current process, but code execution is not the primary standalone impact described for this CVE.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by preventing users from opening untrusted or unsolicited PDF files and from interacting with untrusted PDF content delivered through web pages or other external sources. Enterprise controls such as attachment filtering, content detonation, application isolation, and least-privilege execution can further reduce risk, but patching is the definitive mitigation.
Patch, then assume compromise.
Apply the Adobe security update that fixes CVE-2026-47924. Affected deployments should upgrade Adobe Acrobat Reader to a version newer than 24.001.30365 and 26.001.21651, or to the vendor-provided patched release for the relevant update channel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.