Adobe Acrobat for Edge Out-of-Bounds Write Allows Remote Code Execution
A high-severity flaw in Adobe Acrobat for Edge lets attackers run code via malicious files, requiring user interaction to trigger the exploit.
Key points
- CVE-2026-75747 is rated CVSS 8.8 HIGH by the National Vulnerability Database.
- The flaw is an out-of-bounds write in Adobe Acrobat for Edge up to version 154.0.4258.37.
- Exploitation requires a victim to open a specially crafted malicious file.
Adobe has acknowledged a high-severity vulnerability in its Edge browser extension for Acrobat. The flaw allows arbitrary code execution if a user opens a malicious document.
What happened
The National Vulnerability Database lists CVE-2026-75747 as an out-of-bounds write vulnerability. This issue affects Adobe Acrobat for Edge versions up to and including 154.0.4258.37. The flaw is classified under CWE-787, which covers out-of-bounds write errors.
Security researchers note that exploitation requires specific user interaction. A victim must actively open a malicious file for the code to execute. The execution occurs in the context of the current user. This means an attacker gains the same privileges as the person who opened the file.
Why it matters
The CVSS score of 8.8 places this issue in the high severity range. This rating reflects the potential for remote code execution without initial authentication. However, the requirement for user interaction limits the scope of automated attacks.
Environments using Adobe Acrobat for Edge are exposed to this risk. Teams that manage browser extensions for document viewing should assess their exposure. The vulnerability exists in the software version prior to the fix. The source material does not confirm if a patch is available.
What to watch
- Monitor for unexpected process spawns from the browser extension.
- Check for new network connections originating from the Acrobat plugin.
- Look for attempts to write files outside standard directories.
- Review logs for crashes or unusual memory access patterns.
Signals worth monitoring
Teams usually detect this activity through anomalous process behavior. Check whether the browser extension spawns child processes unexpectedly. Look for network traffic that does not match normal browsing patterns. Monitor for file creation events in sensitive system directories. Security operations teams often see memory corruption indicators in crash dumps. These signals suggest an out-of-bounds write attempt. Containment moves include isolating the affected machine. Disable the extension immediately to stop further execution. Review the opened files for indicators of compromise.
Background: CVSS score
CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.
Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment
What to do and how to stay safe: Adobe
- Restrict the ability to open untrusted PDF files within the browser extension.
- Monitor endpoint logs for unusual behavior from the Acrobat for Edge process.
- Isolate systems that show signs of exploitation until a fix is available.
- Educate users on the risks of opening unexpected documents in the browser.
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-75747?
The National Vulnerability Database rates it as CVSS 8.8 HIGH.
Which versions of Adobe Acrobat for Edge are affected?
Versions up to and including 154.0.4258.37 are affected.
Does the exploit require user interaction?
Yes, a victim must open a malicious file for the issue to be exploited.
