Adobe Acrobat for Edge Out-of-Bounds Write Allows Code Execution
A high-severity flaw in the browser extension allows attackers to run code via malicious files, exposing users who open tainted documents on their systems.
Key points
- The vulnerability is an out-of-bounds write tracked as CVE-2026-75997 with a CVSS score of 8.8, classified as high severity.
- Adobe Acrobat for Edge versions up to 154.0.4258.37 are affected by this issue that requires user interaction to exploit.
- Successful exploitation results in arbitrary code execution in the context of the current user, potentially compromising the local environment.
Adobe Acrobat for Edge contains a memory safety flaw that enables attackers to execute arbitrary code on a victim's machine. The vulnerability is an out-of-bounds write error, a common class of memory corruption bug. This specific issue affects the browser extension version used to view PDF documents within the Microsoft Edge environment. The flaw is significant because it allows an attacker to run code with the privileges of the user currently logged into the system. The vulnerability is tracked as CVE-2026-75997 and is rated as high severity by the National Vulnerability Database.
Root cause
The underlying technical issue is identified as an out-of-bounds write vulnerability, mapped to CWE-787 in the Common Weakness Enumeration database. This type of flaw involves writing data beyond the allocated memory buffer. When the application processes a specially crafted input, it triggers this memory corruption. This corruption can alter program execution flow, allowing an attacker to inject and run their own malicious code. The vulnerability exists within the processing logic of the extension. The source material does not specify the exact code path or validation failure that leads to the out-of-bounds write, only that the weakness is present in the affected versions.
Attack path
Exploitation of this issue requires direct user interaction, meaning the attacker cannot trigger the vulnerability remotely without the victim taking action. According to the National Vulnerability Database record, a victim must open a malicious file to trigger the out-of-bounds write condition. An attacker would likely distribute a crafted PDF document via email or other channels.
When the user opens this file using Adobe Acrobat for Edge, the extension processes the malformed data. Once the memory is corrupted, the attacker’s payload executes, granting them the ability to run code in the context of the current user. This execution happens within the privileges of the user who opened the file.
Affected versions
The vulnerability affects Adobe Acrobat for Edge versions that are older than or equal to 154.0.4258.37. Any installation running version 154.0.4258.37 or any prior release is exposed to this risk. Organizations and individuals using this specific extension version should verify their current installation status immediately. The flaw is specific to the Edge extension component of the Adobe Acrobat ecosystem. Users of newer versions that surpass this build number are not affected by this specific CVE. The source material explicitly lists "up to 154.0.4258.37" as the affected range.
Mitigation
- Update Adobe Acrobat for Edge to a version newer than 154.0.4258.37 as soon as an updated release is available from the vendor.
- Avoid opening PDF files from untrusted sources or unexpected emails, as user interaction is required to exploit the flaw.
- Restrict the ability of browser extensions to process sensitive documents if organizational policy allows for such strict controls.
- Monitor system logs for unexpected processes spawning from the browser extension context, which may indicate active exploitation.
Signals worth monitoring
Teams usually detect memory corruption exploits by observing unusual process creation events originating from the browser or its extensions. Security operations centers should check whether the Adobe Acrobat extension is launching unexpected child processes or attempting to access sensitive system areas. Alerts for out-of-bounds write patterns in endpoint detection and response tools can also reveal this activity. Containment moves typically involve isolating the affected machine from the network to prevent lateral movement. Administrators should also review extension permissions and consider disabling the component until a verified patch is deployed to all endpoints.
What to do and how to stay safe: Adobe
- Verify the installed version of Adobe Acrobat for Edge against the affected build number 154.0.4258.37 to determine exposure.
- Configure email security gateways to block or sandbox executable attachments and suspicious PDF files from unknown senders.
- Enable endpoint detection and response rules that alert on abnormal behavior from browser extensions, such as unexpected memory writes.
- Educate users on the risks of opening unsolicited PDF files, emphasizing that user interaction is required for this specific threat.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-75997?
The vulnerability is rated as high severity with a CVSS score of 8.8 according to the National Vulnerability Database record.
Which software versions are affected by this flaw?
Adobe Acrobat for Edge versions up to and including 154.0.4258.37 are affected by this out-of-bounds write vulnerability.
Is remote exploitation possible without user action?
No, exploitation requires user interaction, specifically that a victim must open a malicious file to trigger the vulnerability.
