ZDI-CAN-29987: ZDI-26-354: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

Published Jun 9, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-47919.

Affected Software

1 affected component

Adobe Acrobat Reader DC

Event History

Jun 9, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-29987?

ZDI-CAN-29987 has a CVSS rating of 7.8, indicating a high severity vulnerability.

How do I fix ZDI-CAN-29987?

To fix ZDI-CAN-29987, ensure that your Adobe Acrobat Reader DC software is updated to the latest version provided by Adobe.

What is the impact of ZDI-CAN-29987?

The impact of ZDI-CAN-29987 is that it allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC.

Is user interaction required for ZDI-CAN-29987 exploitation?

Yes, user interaction is required for ZDI-CAN-29987 exploitation, as the target must either visit a malicious page or open a malicious file.

Which software is affected by ZDI-CAN-29987?

ZDI-CAN-29987 affects Adobe Acrobat Reader DC installations.