CVE-2026-81983: Integer overflow leads to an out-of-bounds write in Adobe Acrobat
Attack Techniques & Methods2026-10-22, 13:35
Remedio researchers discovered CVE-2026-81983 in Adobe Acrobat's image-processing pipeline. The vulnerability is triggered by opening a PDF containing a specially crafted 16-bit image and can cause an out-of-bounds write in
Acrobat.dll.The flaw lies in a function that normalizes 16-bit image samples before compositing. The byte-swapping loop uses the product of the image width and the number of components as its iteration count, without checking it against the buffer size. Meanwhile, the buffer-size check calculates the required data length as
Width × components × 2, using the same 32-bit arithmetic.A CMYK image with a width of
0x20000000 is sufficient to trigger the vulnerability. The product 4 × 0x20000000 yields 0x80000000. Multiplying this by two during the size check causes the 32-bit result to wrap to zero, allowing an image data stream containing just 8 bytes to pass validation.
The byte-swapping loop then uses the original iteration count of 0x80000000, advancing through memory two bytes at a time. The minimized trigger is a 745-byte PDF containing a single image row. The loop reads and writes beyond a 16-byte buffer, with the observed access violation occurring approximately 144 KB beyond the buffer's start.The vulnerable code is part of the 16-bit sample normalization routine, which swaps the bytes of each value directly in the source buffer. Whether this branch executes depends in part on the
keepEndian flag. The minimal trigger uses an image XObject with /BitsPerComponent 16, /ColorSpace /DeviceCMYK, a height of 1, and a width of 0x20000000.Adobe fixed the vulnerability by introducing a 64-bit range check and rejecting sample counts greater than
INT_MAX. The fix was published in security bulletin APSB26-141 on September 8, 2026. The fixed versions are Acrobat / Acrobat Reader Continuous 26.002.21901 and Acrobat 2024 Classic 24.001.30429.Vulnerabilities
Vendors
Products