Organisations urged to patch Adobe Acrobat, Reader to block AI-discovered CVE-2026-81983 remote code execution flaw

Adobe has released a security update for Acrobat and Acrobat Reader to address a high-severity vulnerability tracked as CVE-2026-81983. The flaw allows a malicious PDF to trigger memory corruption, potentially leading to code execution with the rights of the user who opened the file. According to Cyber Security News, the issue stems from an out-of-bounds write in the image pipeline. Adobe states it has not observed active exploitation of this vulnerability in the wild.

How it unfolded

• Researchers used a custom Python fuzzer, built with large language model assistance, to find the flaw.
• The tool generated small, valid PDFs with manipulated image fields to trigger crashes.
• Adobe published the fix in security bulletin APSB26-141 on September 8, 2026.

Who is affected

The vulnerability impacts users of Adobe Acrobat and Acrobat Reader versions prior to the patched releases. Specifically, Acrobat and Reader Continuous versions 26.002.21900 and earlier are affected, as are Acrobat 2024 Classic versions 24.001.30383 and earlier. The flaw exists in Acrobat.dll and involves a 32-bit integer overflow when calculating image sample counts. According to Remedio research, a crafted 16-bit image can cause the calculation to wrap, allowing a short data stream to bypass validation and corrupt memory.

Our take on the response

Adobe addressed the root cause by switching to 64-bit math for sample count calculations and rejecting values exceeding INT_MAX. This prevents the integer overflow that allowed the out-of-bounds write. The vendor issued the fix promptly after the discovery, providing a clear path for remediation. That suggests the update process is effective, but organizations must ensure their deployment mechanisms push the new versions to all endpoints quickly.

Who needs to act first

Teams should prioritize updating systems that handle external documents, such as customer support and finance departments. Verify that patch management tools have detected the new version before forcing a restart. Test the update in a non-production environment to ensure compatibility with existing workflows. Back up critical data before applying the change. Monitor logs for any unexpected application crashes during the rollout phase.

Background: Integer overflow vulnerabilities

Isolate the affected system immediately to stop memory corruption. Collect volatile memory for analysis. Restore from a known good image. Apply compiler flags and runtime checks. Monitor for similar patterns in other services. Review your vulnerability prioritization strategy to catch these flaws earlier.

Read the full guide: Integer Overflow Response: Immediate Containment and Recovery Steps

What to do and how to stay safe: Adobe

• Apply the latest Adobe Acrobat and Reader updates immediately to all managed endpoints.
• Verify that automatic update settings are enabled to prevent future exposure to unpatched versions.
• Educate users to avoid opening PDF files from untrusted sources or unexpected email attachments.
• Monitor network traffic for indicators of compromise that might suggest exploitation attempts.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-81983?

The vulnerability has a CVSS score of 7.8, which is classified as high severity.

Are there specific versions that need updating?

Yes, Acrobat and Reader Continuous 26.002.21900 and earlier, and Acrobat 2024 Classic 24.001.30383 and earlier.

Is the vulnerability being exploited in the wild?

No, Adobe has stated that it has seen no active exploitation of this flaw so far.