CVE-2026-47937

Analyzed Analyzed - Analysis Complete

Uncontrolled Search Path Element in Adobe Acrobat Reader

Publication date: 2026-06-09

Last updated on: 2026-06-29

Assigner: Adobe Systems Incorporated

Description

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-29

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-28

NVD

CVE-2026-47937

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	acrobat_dc	From 15.008.20082 (inc) to 26.001.21662 (exc)
adobe	acrobat_reader_dc	From 15.008.20082 (inc) to 26.001.21662 (exc)
adobe	acrobat	From 24.0.0 (inc) to 24.001.30383 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability affects Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier. It is an Uncontrolled Search Path Element vulnerability that could allow an attacker to execute arbitrary code with the privileges of the current user.

To exploit this vulnerability, the attacker needs the victim to open a malicious file, meaning user interaction is required.

The scope of the vulnerability is changed, indicating that the impact extends beyond the initially vulnerable component.

Impact Analysis

If exploited, this vulnerability can lead to arbitrary code execution in the context of the current user.

This means an attacker could potentially run malicious code with the same permissions as the user who opened the malicious file.

The impact could include unauthorized actions such as data theft, installation of malware, or other malicious activities depending on the user's privileges.

Hi! I’m here to help you understand CVE-2026-47937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70