CVE-2026-81982
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction - the victim must open a malicious file.
Risk Assessment
The risk involves potential leakage of sensitive data from process memory, which could expose the organization to loss of confidential information.
Recommendation
It is recommended to immediately update Acrobat Reader to the latest version containing security fixes. Also educate users not to open files from untrusted sources.
Other vulnerabilities in Acrobat Reader
See all- CVE-2026-82001Medium
Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2026-81997Medium
Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation requires user interaction in that a victim must open a malicious file. Scope is changed.
- CVE-2026-81996High
Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access. Exploitation does not require user interaction. Scope is changed.
- CVE-2026-81994High
Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation requires user interaction in that a victim must open a malicious file. Scope is changed.
- CVE-2026-81993Medium
Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2026-81992High
Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2026-81991Medium
Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2026-81990High
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2026-81989High
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2026-81988High
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.
Original NVD description (English source)
Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

