# Adobe Acrobat/Reader Integer Overflow in Acrobat.dll Enables Malicious-PDF Memory Corruption (CVE-2026-81983)

> A 32-bit integer overflow in Acrobat.dll's image pipeline bypasses a size check and causes an out-of-bounds write when a user opens a crafted PDF, allowing code execution as the current user. A 745-byte proof-of-concept PDF exists; no in-the-wild exploitation is reported. Fixed in Adobe bulletin APSB26-141 (2026-09-08).

- **Published:** 2026-10-16T04:22:12Z
- **Last reviewed:** 2026-10-16T04:22:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3703
- **ID:** TL-2026-3703
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-81983

## Description

CVE-2026-81983 is an out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader, rooted in a 32-bit integer overflow in Acrobat.dll's image pipeline. When processing an image, the code computes the sample count by multiplying image width by the number of color components. A subsequent size validation performed with 32-bit arithmetic wraps to a tiny value when the width is oversized, so an insufficient buffer size is accepted. The byte-swap loop that follows continues to read and write beyond the allocated buffer, producing heap memory corruption.

The published proof of concept is a 745-byte PDF containing a single crafted 16-bit image: width 536,870,912 pixels, height 1, DeviceCMYK color space (4 components), 16 bits per component, giving a sample count of 0x80000000 that wraps the 32-bit check. Opening the file is sufficient to trigger the bug; no further interaction is needed beyond the victim opening the document. Per NVD/INCIBE, successful exploitation can yield arbitrary code execution in the context of the current user (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, 7.8 HIGH).

The issue was identified by the Remedio research team using a custom Python fuzzer developed with LLM assistance. Per the reporting source, no active exploitation has been observed. Adobe fixed the issue in APSB26-141 (2026-09-08) by switching sample-count calculations to 64-bit math with an INT_MAX validation. Affected: Acrobat/Acrobat Reader Continuous 26.002.21900 and earlier, and Acrobat 2024 Classic 24.001.30383 and earlier. Fixed in Continuous 26.002.21901 and Classic 24.001.30429. Because a public PoC exists and PDFs are a common delivery format, defenders should patch promptly and monitor for anomalous PDF-reader crashes and child-process activity. No network IOCs, hashes, or attribution are published.

## MITRE ATT&CK

- T1587.004 Exploits
- T1588.005 Exploits
- T1566.001 Spearphishing Attachment
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File

## Sources

- [Critical Adobe Acrobat Flaw Lets Malicious PDFs Trigger One-Click Memory Corruption](https://cybersecuritynews.com/adobe-acrobat-flaw/)
- [Adobe Security Bulletin APSB26-141](https://helpx.adobe.com/security/products/acrobat/apsb26-141.html)
- [INCIBE-CERT: CVE-2026-81983](https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-81983)
- [NVD: CVE-2026-81983](https://nvd.nist.gov/vuln/detail/CVE-2026-81983)
- [stack.watch: CVE-2026-81983](https://stack.watch/vuln/CVE-2026-81983/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3703