Acrobat for Edge OOB Write CVE-2026-75747 Lets Attackers Run Code on Versions Up to 154.0.4258.37

Adobe Acrobat for Edge contains an out-of-bounds write vulnerability that permits arbitrary code execution within the context of the current user, according to the National Vulnerability Database. This flaw, tracked as CVE-2026-75747, carries a CVSS score of 8.8, classifying it as high severity. Security operations teams must note that exploitation requires user interaction, specifically the opening of a malicious file by the victim.

Root cause

The underlying weakness is identified as CWE-787, an out-of-bounds write error. This type of memory corruption issue occurs when a program writes data beyond the allocated buffer boundaries. In the context of Adobe Acrobat for Edge, this flaw allows an attacker to overwrite adjacent memory, potentially leading to arbitrary code execution. The NVD record confirms this specific technical classification without providing further architectural details on the affected component.

Attack path

Exploitation of CVE-2026-75747 is not remote in the traditional sense; it requires direct user involvement. An attacker must deliver a specially crafted malicious file to the target. The victim must then open this file using the vulnerable version of Acrobat for Edge. Once the file is processed, the out-of-bounds write triggers, allowing code to run under the current user’s privileges. This interaction requirement limits automated mass exploitation but remains a significant risk for targeted campaigns.

Affected versions

• Adobe Acrobat for Edge versions up to and including 154.0.4258.37 are affected by this vulnerability.
• The NVD record does not specify earlier versions, but explicitly lists 154.0.4258.37 as the upper bound of the affected range.
• Teams should verify their current deployment version against this threshold to determine exposure.

Mitigation

• Restrict the opening of untrusted PDF files in corporate environments.
• Ensure endpoint detection and response tools are active on systems running Acrobat for Edge.
• Monitor for unusual process creation or memory access patterns indicative of exploitation attempts.

Signals worth monitoring

Teams usually observe anomalous process spawns or unexpected memory writes when out-of-bounds errors are exploited. Check whether endpoint logs show Acrobat for Edge initiating connections to unknown hosts or spawning child processes like command shells. Look for alerts related to integrity violations or unexpected DLL loads within the application context. If such behaviour is detected, isolate the affected workstation immediately to prevent lateral movement. Review file creation events in temporary directories for artifacts left by the malicious payload.

Background: CVSS score

A CVE is a unique identifier for a specific security flaw, acting like a name tag. A CVSS score is a numerical rating of that flaw’s severity. You use the CVE to find the issue and the CVSS score to decide how urgently you must fix it. They serve different functions in your workflow.

Read the full guide: Difference Between CVE and CVSS Score: How to Priorise Remediation

What to do and how to stay safe: Adobe

• Audit inventory for installations of Adobe Acrobat for Edge version 154.0.4258.37 or lower.
• Implement application control policies to restrict execution of scripts from PDF viewers.
• Educate users to avoid opening unsolicited PDF attachments from unknown sources.
• Monitor for vendor announcements regarding a security update for this CVE.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-75747?

The NVD rates CVE-2026-75747 as high severity with a CVSS score of 8.8.

Does this vulnerability allow remote exploitation without user action?

No, exploitation requires user interaction, specifically the opening of a malicious file.

Which versions of Acrobat for Edge are affected?

Adobe Acrobat for Edge up to version 154.0.4258.37 is affected.