Adobe patched a high-severity flaw in Acrobat and Reader that lets malicious PDFs run code. Users must install the latest build to stay safe.
Key points
- CVE-2026-81983 is a high-severity integer overflow in Adobe products.
- The flaw allows remote code execution when a user opens a crafted PDF.
- Adobe released patches for Acrobat and Reader on September 8, 2026.
Adobe released security updates for Acrobat and Reader to fix a high-severity flaw. The vulnerability allows attackers to run malicious code on a victim's computer.
What happened
Researchers used an AI-assisted fuzzer to discover CVE-2026-81983 in Adobe Acrobat and Reader. According to Cyber Security News, the flaw is an out-of-bounds write with a CVSS score of 7.8. It resides in the image processing pipeline, which activates as soon as a PDF opens.
The tool generated small, valid PDF documents with manipulated image fields. A proof-of-concept used a tiny 745-byte file containing a crafted 16-bit image. This triggered a 32-bit integer overflow in Acrobat.dll, causing memory corruption.
The bug occurs because Acrobat calculates image sample counts using 32-bit math. A large width value causes the calculation to wrap to a tiny number. This allows short data streams to pass validation while the code writes past buffer limits.
Adobe stated it has seen no active exploitation of this zero-day flaw. The issue affects Acrobat and Reader Continuous versions up to 26.002.21900. It also impacts Acrobat 2024 Classic versions up to 24.001.30383.
Why it matters
Users need to understand why this specific bug is dangerous. An integer overflow happens when a calculation exceeds the maximum value a variable can hold. The number wraps around to zero or a small value, bypassing safety checks.
This allows attackers to trick the software into accepting invalid data. The program then writes data outside its allocated memory space. This memory corruption can let an attacker run arbitrary code with the user's permissions.
The fix
- Install Adobe Acrobat and Reader Continuous version 26.002.21901 or later.
- Update Acrobat 2024 Classic to version 24.001.30429 or later.
- Apply the patch distributed in security bulletin APSB26-141.
Why it matters
Teams usually prioritize patching applications that process untrusted files. Check whether your organization has automated update mechanisms for Adobe products. Ensure that PDF viewing is restricted to trusted sources where possible.
Monitor for unusual process behavior after opening documents. Educate users on the risks of opening unexpected attachments. Verify that security tools are configured to inspect PDF content before it reaches the user.
What to do and how to stay safe: Adobe
- Update Adobe Acrobat and Reader to the latest available version immediately.
- Avoid opening PDF files from unknown or untrusted senders.
- Keep your operating system and security software up to date.
- Scan downloaded files with antivirus software before opening them.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-81983?
It is a high-severity integer overflow flaw in Adobe Acrobat and Reader that allows remote code execution.
Is this flaw being exploited in the wild?
Adobe says it has seen no active exploitation of this vulnerability so far.
Which Adobe versions are affected?
Acrobat and Reader Continuous up to 26.002.21900 and Acrobat 2024 Classic up to 24.001.30383 are affected.
