Adobe has patched a vulnerability in Acrobat and Acrobat Reader that allows a malicious PDF to corrupt memory when opened. Tracked as CVE-2026-81983, the out-of-bounds write has a CVSS score of 7.8 and could enable code execution with the same privileges as the user who opens the file.
Adobe reports no active exploitation at this time. The flaw exists in Acrobat’s image processing pipeline, the code path that begins parsing image data as soon as a PDF is opened.
Researchers who discovered the bug used a custom Python fuzzer, developed largely with assistance from a large language model. Rather than randomly mutating whole PDF files, the fuzzer created small, valid documents and altered specific image fields such as width, height, bit depth, color space, filters, and sample bytes. The most effective crash came from a crafted 16-bit image embedded in a PDF only 745 bytes in size.
The underlying cause is a 32-bit integer overflow in Acrobat.dll. Acrobat computes the number of image samples by multiplying an image’s width by its number of color components. A separate size check then adds two bytes per 16-bit sample. When the image width is very large, this later calculation overflows 32-bit arithmetic and wraps to a small value, so Acrobat accepts an excessively short data stream.
How the Acrobat flaw works
A byte-swap loop still uses the original (very large) sample count and continues reading and writing past the end of a 16-byte buffer, causing memory corruption and potentially enabling an attacker to run code. A proof-of-concept image used a width of 536,870,912, a height of 1, 16 bits per component, and the DeviceCMYK color space. With four CMYK components, the sample count became 0x80000000.
Remedio’s analysis shows the related byte-size calculation reached 0x100000000 and wrapped to zero under 32-bit arithmetic, which allowed an eight-byte stream to pass validation. Simply opening the PDF is sufficient to reach the faulty image-rendering path.
The CVSS vector indicates a local attack vector, low attack complexity, no privileges required, and that user interaction is necessary. A successful exploit could have a high impact on confidentiality, integrity, and availability, but attackers must still deliver the malicious document — for example via email, chat, or file download — to a target.
Adobe’s fix switches to 64-bit arithmetic when calculating the sample count and rejects values greater than INT_MAX before touching memory. The patch was released in security bulletin APSB26-141 on September 8, 2026.
Patched releases include Acrobat and Reader Continuous updated from 26.002.21900 (and earlier) to 26.002.21901, and Acrobat 2024 Classic updated from 24.001.30383 (and earlier) to 24.001.30429.
Users and administrators should install the updated versions immediately, keep automatic updates enabled, and exercise caution with unexpected PDF attachments. Security teams should filter suspicious PDFs at email gateways and monitor for crashes related to Acrobat.dll. Adobe lists CVE-2026-81983 as critical, and the NVD entry confirms exploitation requires a victim to open a crafted file.
The finding also illustrates how targeted, AI-assisted fuzzing can uncover deep flaws in long-standing file parsers. For broader context on PDF-related threats, readers may review prior reports on Acrobat and Reader vulnerabilities that allowed arbitrary code execution and past zero-days exploited through malicious PDFs.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
