Critical Adobe Acrobat Flaw Lets Malicious PDFs Trigger One-Click Memory Corruption

Adobe has fixed a flaw in Acrobat and Acrobat Reader that lets a malicious PDF corrupt memory when a user opens it. Tracked as CVE-2026-81983, the out-of-bounds write carries a CVSS score of 7.8 and could lead to code execution with the victim’s user rights.

Adobe says it has seen no active exploitation so far. The bug sits in Acrobat’s image pipeline, code that starts parsing image data as soon as a PDF opens.

Researchers found it with a custom Python fuzzer built largely with help from a large language model. Instead of randomly modifying full PDF files, the tool created small, valid documents.

It changed image fields such as width, height, bit depth, color space, filters, and sample bytes. The strongest crash came from a crafted 16-bit image inside a PDF only 745 bytes in size.

The root cause is a 32-bit integer overflow in Acrobat.dll. Acrobat calculates the number of image samples by multiplying an image’s width by its color component count.

A second size check adds two bytes for every 16-bit sample. With a very large width, this later value wraps to a tiny number, so Acrobat accepts a very short data stream.

Adobe Acrobat Flaw

The byte-swap loop still sees a huge sample count and keeps reading and writing past the end of a 16-byte buffer. This causes memory corruption and may give an attacker a path to run code.

A proof-of-concept image used a width of 536,870,912, a height of one, 16 bits per component, and the DeviceCMYK color space. Four CMYK components produced a sample count of 0x80000000.

According to Remedio research, the related byte-size calculation reached 0x100000000 and wrapped to zero in 32-bit math, allowing an eight-byte stream to pass validation.

Opening the PDF was enough to reach the faulty image-rendering path. The CVSS vector shows a local attack path, low attack complexity, no privileges, and required user interaction.

A successful exploit can have high impact on confidentiality, integrity, and availability. In practice, attackers still need to deliver the malicious document via email, chat, downloads, or another route.

Adobe fixed the issue by using 64-bit math to calculate the sample count and rejecting values above INT_MAX before touching memory. The fix arrived in security bulletin APSB26-141 on September 8, 2026.

Adobe patched Acrobat and Reader Continuous 26.002.21900 and earlier with version 26.002.21901. Acrobat 2024 Classic 24.001.30383 and earlier was updated to 24.001.30429.

Users and administrators should install the fixed releases without delay, keep automatic updates enabled, and treat unexpected PDF attachments with care.

Security teams should also filter suspicious PDFs at email gateways and watch for crashes tied to Acrobat.dll. Adobe lists CVE-2026-81983 as critical, while the NVD record confirms that exploitation needs a victim to open a crafted file.

The finding also shows how focused, AI-assisted fuzzing can find deep bugs in old file parsers. Readers can review our earlier coverage of Adobe Acrobat Reader flaws that allow arbitrary code execution and the Adobe Acrobat zero-day exploited through malicious PDFs for wider context on PDF security risks.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.