CVE-2026-81983

Published Sep 8, 2026

Last updated a month ago

CVSS high 7.8

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-81983 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. Disclosed in September 2026 as part of Adobe's APSB26-141 security bulletin, the flaw resides within the application's image pipeline. It stems from an integer overflow where a file-controlled count, computed using 32-bit arithmetic, is trusted as a loop bound. Because the upstream size check shares the same wrapping arithmetic, it fails to validate the input properly, allowing data to be written outside the allocated memory buffer. Exploitation of this vulnerability requires user interaction, meaning a victim must open a specially crafted, malicious PDF document. If a user opens such a file, the memory corruption caused by the out-of-bounds write can allow an attacker to execute arbitrary code within the security context of the current user. The vulnerability was discovered by security researchers using a custom, large language model (LLM)-generated fuzzer that targeted the software's image parsing decoders.

Description
Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Source
psirt@adobe.com
NVD status
Analyzed
Products
acrobat, acrobat_dc, acrobat_reader_dc

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

psirt@adobe.com
CWE-787

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

27

  1. A 745-byte PDF is enough to trigger a critical memory corruption vulnerability in Adobe Acrobat. CVE-2026-81983 | CVSS 7.8 | Critical Security researchers at Remedio discovered an integer overflow in Adobe Acrobat’s image-processing pipeline that leads to an out-of-bounds writ

    @ProximusLabs

    22 Oct 2026

    131 Impressions

    0 Retweets

    4 Likes

    0 Bookmarks

    2 Replies

    0 Quotes

  2. CVE-2026-81983: Integer overflow leads to an out-of-bounds write in Adobe Acrobat Read on dbugs: https://t.co/KZctvfMZ1d Remedio researchers discovered CVE-2026-81983 (https://t.co/A7H8n37EPX) in Adobe Acrobat's image-processing pipeline. The vulnerability is triggered by

    @ptdbugs

    22 Oct 2026

    30734 Impressions

    14 Retweets

    91 Likes

    46 Bookmarks

    4 Replies

    10 Quotes

Configurations

Related CVEs

  1. Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.•CVE-2026-82001
  2. Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.•CVE-2026-81997
  3. Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed.•CVE-2026-81996
  4. Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.•CVE-2026-81994
  5. Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.•CVE-2026-81993

References

Sources include official advisories and independent security research.