Adobe Patches Critical Zero-Day in Acrobat Reader Found by AI Fuzzer

Adobe has released patches for a critical zero-day vulnerability in Acrobat and Acrobat Reader that allows malicious PDFs to trigger memory corruption. Tracked as CVE-2026-81983, the flaw enables code execution with the victim’s user rights when a crafted document is opened.

The out-of-bounds write carries a CVSS score of 7.8, which rates as high severity. According to Cyber Security News, Adobe states it has observed no active exploitation of this issue in the wild. The bug resides in the image pipeline code that begins parsing data immediately upon opening a file.

Technical Details of the Discovery

Researchers identified the flaw using a custom Python fuzzer developed with significant help from a large language model. Instead of modifying entire PDF files randomly, the tool generated small, valid documents with altered image fields. These fields included width, height, bit depth, color space, filters, and sample bytes.

The most effective crash occurred with a crafted 16-bit image inside a PDF only 745 bytes in size. According to Remedio research, the root cause is a 32-bit integer overflow in Acrobat.dll. The software calculates image samples by multiplying width by color component count, leading to incorrect size checks.

When processing a very large width, the calculated value wraps to a tiny number in 32-bit math. This allows a short data stream to pass validation while the byte-swap loop continues reading past a 16-byte buffer. A proof-of-concept used a width of 536,870,912 and DeviceCMYK color space to trigger the overflow.

Affected Versions and Fixes

Adobe addressed the issue by switching to 64-bit math for sample count calculations and rejecting values above INT_MAX before memory access. The fix was included in security bulletin APSB26-141, published on September 8, 2026.

Users of Acrobat and Reader Continuous version 26.002.21900 and earlier should update to version 26.002.21901. For those using Acrobat 2024 Classic, versions 24.001.30383 and earlier must be updated to version 24.001.30429 to resolve the vulnerability.

What should you do?

Administrators should verify that all endpoints have received the latest Adobe updates corresponding to their installed version. Users should remain cautious of unsolicited PDF attachments in email or chat messages. Security teams should monitor for any reports of active exploitation attempts targeting this specific CVE.

Background: Large language models

Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.

Read the full guide: Large Language Models vs Generative AI: The Distinction and Security Implications

What to do and how to stay safe: Adobe

• Verify that Adobe Acrobat and Reader are updated to the latest patched versions listed in APSB26-141.
• Inspect email and messaging logs for unexpected PDF attachments that may attempt to trigger the image pipeline flaw.
• Ensure endpoint detection tools are configured to alert on suspicious memory corruption behaviors in PDF readers.
• Review firewall and proxy logs for unusual traffic patterns that might indicate attempts to deliver malicious documents.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-81983?

The vulnerability has a CVSS score of 7.8, which is classified as high severity.

Has Adobe confirmed any active exploitation of this flaw?

No, Adobe states that it has seen no active exploitation of CVE-2026-81983 so far.

Which Adobe products are affected by this vulnerability?

Adobe Acrobat and Acrobat Reader versions prior to the September 8, 2026 updates are affected.