ZDI-26-672: Adobe Acrobat Reader DC PDF File Parsing Integer Underflow Information Disclosure Vulnerability

Zerodayinitiative • September 10, 2026

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before reading from memory. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

Adobe has issued an update to correct this vulnerability. More details can be found at:

2026-06-30 - Vulnerability reported to vendor

2026-09-10 - Coordinated public release of advisory

2026-09-10 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Adobe Acrobat Vulnerabilities Disclosed on September 10, 2026 On September 10, 2026, multiple vulnerabilities affecting Adobe Acrobat Pro DC and Adobe Acrobat Reader DC were disclosed, allowing remote attackers to execute arbitrary code or disclose sensitive information. The vulnerabilities include integer overflows, underflows, and use-after-free conditions, primarily related to the parsing of various file formats such as JPEG, PDF, and JBIG2. User interaction is required for exploitation, as victims must visit malicious pages or open harmful files. Adobe has issued updates to address these vulnerabilities. The vulnerabilities are tracked under several advisories, including ZDI-26-658, ZDI-26-672, and ZDI-26-668, among others. The flaws could potentially allow attackers to leverage them in conjunction with other vulnerabilities for more severe exploits. Administrators are urged to apply the updates immediately to mitigate risks. 21 sources 61

Extracted Entities

ZDI-26-672: Adobe Acrobat Reader DC PDF File Parsing Integer Underflow Information Disclosure Vulnerability

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Vulnerabilities (1)