CVE-2026-47937 — Acrobat Reader | Uncontrolled Search Path Element (CWE-427)

Description (CNA)

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Affected (CNA)

Vendor / product	Versions
Adobe / Acrobat DC	affected 0 through 26.001.21651; unaffected 26.001.21662
Adobe / Acrobat Reader DC	affected 0 through 26.001.21651; unaffected 26.001.21662
Adobe / Acrobat 2024	affected 0 through 24.001.30365; unaffected 24.001.30383

CWE

CWE-427

References

https://helpx.adobe.com/security/products/acrobat/apsb26-63.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.