One Click, Full Corruption: Critical Adobe Acrobat Flaw Found by AI-Assisted Fuzzing
Read Time:3 Minute, 37 Second
Adobe has patched a critical memory-corruption flaw in Acrobat and Acrobat Reader that co
Altro...
Read Time:3 Minute, 37 Second
Adobe has patched a critical memory-corruption flaw in Acrobat and Acrobat Reader that co
Altro...Read Time:3 Minute, 37 Second
Adobe has patched a critical memory-corruption flaw in Acrobat and Acrobat Reader that could let an attacker gain code execution simply by getting a victim to open a malicious PDF — no further interaction required. The vulnerability, tracked as CVE-2026-81983 and carrying a CVSS score of 7.8, lives inside Acrobat’s image-rendering pipeline, the code that begins parsing embedded image data the moment a PDF is opened.
Found by an AI-Assisted FuzzerThe bug’s discovery is itself a notable detail. Researchers at Remedio built a custom Python fuzzing tool, developed largely with help from a large language model, that took a more surgical approach than typical fuzzing. Rather than randomly corrupting entire PDF files and hoping something breaks, the tool generated small, structurally valid documents and then deliberately manipulated specific image fields — width, height, bit depth, color space, filters, and sample byte data.
That targeted approach paid off quickly. The most reliable crash came from a PDF just 745 bytes in size, containing a single crafted 16-bit image.
The Math Behind the BugAt its core, this is a classic integer overflow dressed up in modern image-parsing code. Acrobat calculates the total number of image samples by multiplying an image’s declared width by its color component count, then performs a secondary size check that adds two bytes for every 16-bit sample. The problem surfaces when that width value is extreme enough to make the resulting calculation wrap around 32-bit integer limits.
In the researchers’ proof-of-concept, a crafted image declared a width of 536,870,912 pixels, a height of one, 16 bits per color component, and the DeviceCMYK color space — four color components, which produced a sample count of 0x80000000. The related byte-size calculation then reached 0x100000000, which wraps to zero in standard 32-bit arithmetic. That wraparound let an eight-byte data stream sail past validation that should have rejected it outright.
From there, Acrobat’s byte-swap loop still believes it’s working with the original, enormous sample count, so it keeps reading and writing far past the end of a buffer that’s only 16 bytes long — corrupting memory and opening a path toward arbitrary code execution under the victim’s own user privileges.
Real-World RiskThe CVSS vector for CVE-2026-81983 describes a local attack path with low complexity, no privileges required, but mandatory user interaction — meaning a victim does need to actually open the malicious file. That’s a meaningful caveat, but in practice, getting a target to open a PDF is one of the easier social-engineering hurdles to clear: email attachments, chat links, and drive-by downloads all remain common delivery routes for malicious documents.
Adobe says it has not observed active exploitation of this vulnerability so far, though that assessment can change quickly once a patch highlights exactly where the flaw lives for anyone willing to reverse-engineer it.
The Fix and Affected VersionsAdobe addressed the root cause by switching the sample-count calculation to 64-bit math and explicitly rejecting any value above INT_MAX before it can touch memory. The fix shipped in security bulletin APSB26-141 on September 8, 2026, covering:
Acrobat and Reader Continuous — versions 26.002.21900 and earlier, fixed in 26.002.21901
Acrobat 2024 Classic — version 24.001.30383 and earlier, fixed in 24.001.30429
What Users and Administrators Should DoGiven how simple the delivery mechanism is — just opening a file — prompt patching matters more than usual here:
Install the fixed Acrobat and Reader builds immediately and confirm automatic updates remain enabled going forward.
Treat unsolicited or unexpected PDF attachments with the same caution typically reserved for executable files.
Security teams should filter suspicious PDFs at email gateways and flag file types or sources associated with past phishing campaigns.
Watch for unexplained crashes tied to Acrobat.dll across the fleet, which could indicate exploitation attempts even before confirmed reports emerge.
This isn’t the first time a crafted PDF has exposed deep parsing bugs in Acrobat, and the use of AI-assisted fuzzing to find it so efficiently suggests more issues like it may surface in older file-format parsers going forward. For now, the fix is available and the action item is straightforward: update Acrobat and Reader without delay.
