CVE-2026-81983

Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions prior to 26.002.21901 Adobe Acrobat Reader versions prior to 26.002.21901 Adobe Acrobat 2024 Classic versions prior to 24.001.30429

Description An integer overflow exists in the image-processing pipeline of the software, specifically within a routine in Acrobat.dll responsible for normalizing 16-bit image samples before compositing. The issue occurs when the application calculates the required buffer size using 32-bit arithmetic (Width × Components × 2), which can wrap around if the image dimensions are sufficiently large. This results in a mismatch between the allocated buffer size and the actual number of samples processed. A byte-swapping routine then performs an out-of-bounds write by operating beyond the allocated memory boundaries. This flaw can be triggered by opening a specially crafted PDF file containing malformed 16-bit image metadata, such as a CMYK image with a width of 0x20000000. Successful exploitation could lead to memory corruption and arbitrary code execution in the context of the current user, requiring only that the victim opens the malicious file.

Recommendations Update Adobe Acrobat to version 26.002.21901 or later. Update Adobe Acrobat Reader to version 26.002.21901 or later. Update Adobe Acrobat 2024 Classic to version 24.001.30429 or later.