ZDI-26-658: Adobe Acrobat Pro DC JPEG Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81987.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because remote exploitation requires user interaction (target must visit a malicious page or open a malicious file), reduce exposure by educating users and restricting delivery of untrusted files/links that could lead to Adobe Acrobat Pro DC opening a malicious page or file.
- Compensating control
Apply the ZDI-26-658 mitigation guidance for Adobe Acrobat Pro DC JPEG Parsing Integer Overflow (ZDI-26-658) to reduce the risk of remote code execution via CVE-2026-81987.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must persuade the target to visit a malicious page or open a malicious file. Successful exploitation can result in arbitrary code execution on the affected Adobe Acrobat Pro DC installation.
Who is exposed to this vulnerability?
Users of affected Adobe Acrobat Pro DC installations are exposed when they interact with attacker-controlled web content or files. The provided information does not identify specific affected versions or configurations.
How severe is the issue?
ZDI assigned this vulnerability a CVSS score of 7.8. It is tracked as CVE-2026-81987.