ZDI-26-670: Adobe Acrobat Pro DC Doc Object Out-Of

Zerodayinitiative • September 10, 2026

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

Adobe has issued an update to correct this vulnerability. More details can be found at:

2026-06-02 - Vulnerability reported to vendor

2026-09-10 - Coordinated public release of advisory

2026-09-10 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Adobe Acrobat Vulnerabilities Disclosed on September 10, 2026 On September 10, 2026, multiple vulnerabilities affecting Adobe Acrobat Pro DC and Adobe Acrobat Reader DC were disclosed, allowing remote attackers to execute arbitrary code or disclose sensitive information. The vulnerabilities include integer overflows, underflows, and use-after-free conditions, primarily related to the parsing of various file formats such as JPEG, PDF, and JBIG2. User interaction is required for exploitation, as victims must visit malicious pages or open harmful files. Adobe has issued updates to address these vulnerabilities. The vulnerabilities are tracked under several advisories, including ZDI-26-658, ZDI-26-672, and ZDI-26-668, among others. The flaws could potentially allow attackers to leverage them in conjunction with other vulnerabilities for more severe exploits. Administrators are urged to apply the updates immediately to mitigate risks. 41 sources 61

Extracted Entities

ZDI-26-670: Adobe Acrobat Pro DC Doc Object Out-Of

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Tools (1)