ZDI-CAN-30689: ZDI-26-352: Adobe Acrobat Pro DC AcroForm Use-After-Free Remote Code Execution Vulnerability

Published Jun 9, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-47917.

Affected Software

1 affected component

Adobe Acrobat Pro DC

Event History

Jun 9, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-30689?

ZDI-CAN-30689 has a CVSS rating of 7.8, indicating a high severity risk.

How do I fix ZDI-CAN-30689?

To fix ZDI-CAN-30689, ensure that you have the latest version of Adobe Acrobat Pro DC installed, as updates often include patches for vulnerabilities.

What type of attack does ZDI-CAN-30689 enable?

ZDI-CAN-30689 enables remote code execution attacks when a user interacts with a malicious page or file.

What software is affected by ZDI-CAN-30689?

ZDI-CAN-30689 affects Adobe Acrobat Pro DC installations.

Is user interaction required to exploit ZDI-CAN-30689?

Yes, user interaction is required as the vulnerability is exploited through a malicious page or file.