ZDI-CAN-30785: ZDI-26-663: Adobe Acrobat Pro DC Annotation Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81989.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply ZDI-26-663 mitigations for Adobe Acrobat Pro DC Annotation Use-After-Free Remote Code Execution: require user interaction (avoid opening untrusted files and visiting untrusted pages) to reduce exploitability.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must persuade the target to visit a malicious page or open a malicious file. Successful exploitation can result in arbitrary code execution on the affected Adobe Acrobat Pro DC installation.
Who is exposed to this vulnerability?
Users of affected Adobe Acrobat Pro DC installations are exposed when they interact with attacker-controlled web content or files. The provided information does not identify affected version ranges or whether a default configuration is vulnerable.
How severe is this issue?
ZDI assigned this vulnerability a CVSS score of 7.8. It is tracked as CVE-2026-81989.