ZDI-26-674: Adobe Acrobat Reader DC Annotation Out-Of

Zerodayinitiative • September 10, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Adobe has issued an update to correct this vulnerability. More details can be found at:

2026-06-18 - Vulnerability reported to vendor

2026-09-10 - Coordinated public release of advisory

2026-09-10 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Adobe Acrobat Vulnerabilities Disclosed on September 10, 2026 On September 10, 2026, multiple vulnerabilities affecting Adobe Acrobat Pro DC and Adobe Acrobat Reader DC were disclosed, allowing remote attackers to execute arbitrary code or disclose sensitive information. The vulnerabilities include integer overflows, underflows, and use-after-free conditions, primarily related to the parsing of various file formats such as JPEG, PDF, and JBIG2. User interaction is required for exploitation, as victims must visit malicious pages or open harmful files. Adobe has issued updates to address these vulnerabilities. The vulnerabilities are tracked under several advisories, including ZDI-26-658, ZDI-26-672, and ZDI-26-668, among others. The flaws could potentially allow attackers to leverage them in conjunction with other vulnerabilities for more severe exploits. Administrators are urged to apply the updates immediately to mitigate risks. 21 sources 61

Extracted Entities

ZDI-26-674: Adobe Acrobat Reader DC Annotation Out-Of

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)