CVE-2026-47937

Published: Jun 9, 2026Modified: Jun 12, 2026

8.2

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.5 / Impact: 6.0

Source: NVD

Description

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Affected (3)

Products: Adobe: Acrobat Dc, Acrobat Reader Dc, Acrobat

3 products

Acrobat Reader Dc

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Adobe Acrobat Dc	From 15.008.20082 to 26.001.21662
Adobe Acrobat Reader Dc	From 15.008.20082 to 26.001.21662

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Adobe Acrobat	From 24.0.0 to 24.001.30383

Running on/with	Platform Versions
Apple Macos	All versions
Microsoft Windows	All versions

Related CWEs

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (1)

https://helpx.adobe.com/security/products/acrobat/apsb26-63.html

Source: psirt@adobe.com

Vendor Advisory

Timeline

No history available yet.