Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑27220) Threatens Document Workflows

Critical Use‑After‑Free RCE in Adobe Acrobat Reader DC (CVE‑2026‑27220) Threatens Document Workflows

What It Is — A use‑after‑free flaw in the handling of Annotation objects allows a remote attacker to execute arbitrary code on systems running Adobe Acrobat Reader DC. The vulnerability (CVE‑2026‑27220) scores 7.8 (CVSS v3.1) and is classified as high severity.

Exploitability — Exploitation requires user interaction: the victim must open a malicious PDF or visit a crafted web page that triggers the vulnerable code path. No public exploit has been observed, but a proof‑of‑concept exists and a patch is already available from Adobe.

Affected Products — Adobe Acrobat Reader DC (all supported versions prior to the June 2026 security update).

TPRM Impact — Organizations that rely on Adobe Reader for contract signing, regulatory filings, or internal communications face a supply‑chain risk. Successful exploitation could lead to malware execution in the context of trusted users, exposing confidential documents and potentially providing a foothold for broader network compromise.

Recommended Actions —

1. Deploy Adobe’s June 2026 security update (APS‑B26‑26) to all endpoints immediately.
2. Enforce strict controls on PDF handling: disable JavaScript, block external content, and restrict annotation features where not required.
3. Conduct user awareness training emphasizing the danger of opening unsolicited PDFs or clicking links to unknown documents.
4. Consider temporary use of alternative, hardened PDF viewers for high‑risk environments until the patch is verified.
5. Monitor endpoint telemetry for anomalous process launches originating from Acrobat.exe.

Source: Zero Day Initiative Advisory – ZDI‑26‑355