Information Disclosure in Adobe Acrobat Reader DC (CVE-2026-47923) Risks Sensitive Data Leakage

Information Disclosure in Adobe Acrobat Reader DC (CVE‑2026‑47923) Risks Sensitive Data Leakage

What It Is – Adobe Acrobat Reader DC contains an out‑of‑bounds read flaw in the handling of Doc objects. When a malicious PDF or web page is opened, the vulnerable component can read memory beyond its allocated buffer, exposing potentially sensitive information.

Exploitability – The vulnerability requires user interaction (opening a crafted PDF or visiting a malicious page). No public exploit code is known, and the CVSS 3.3 rating (AV:L/AC:L/PR:N/UI:R) classifies it as a low‑severity information‑disclosure issue.

Affected Products – Adobe Acrobat Reader DC (all supported versions prior to the June 2026 security update).

TPRM Impact –

• Third‑party vendors that embed or rely on Acrobat Reader for document handling may inadvertently expose internal data to attackers.
• The flaw can be chained with other remote‑code‑execution bugs, increasing the risk of a supply‑chain compromise.

Recommended Actions –

1. Deploy Adobe’s June 2026 security update (APS‑B26‑63) to all endpoints immediately.
2. Enforce strict file‑type controls: block execution of untrusted PDFs from external sources.
3. Monitor endpoint logs for anomalous PDF parsing activity and correlate with threat‑intel feeds.
4. Update your TPRM inventory to flag any third‑party services that require Acrobat Reader on client machines.

Source: Zero Day Initiative Advisory – ZDI‑26‑344