Advisory · CVE-2026-100134
Adobe Acrobat for Edge out-of-bounds write can give code execution when a malicious file is opened
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user when a victim opens a malicious file. CVSS 3.1 8.8.
- Vendor
- Adobe
- Product
- Acrobat for Edge
- Identifier / CWE
- CVE-2026-100134
CWE-787 - Action timing
- Immediate
Explain it like I’m five
A rigged PDF can write outside the memory Acrobat for Edge set aside for it, so opening the file can run attacker code with the signed-in user permissions.
- 01Malicious file delivered
An attacker delivers a specially crafted file to a user of Acrobat for Edge.
- 02Victim opens file
The victim opens the malicious file, which is the user interaction this vulnerability requires.
- 03Out-of-bounds write triggered
The file triggers an out-of-bounds write (CWE-787) in the affected version.
- 04Code execution in user context
Per Adobe, the result can be arbitrary code execution in the context of the current user.
What happened
Adobe disclosed CVE-2026-100134: Acrobat for Edge is affected by an out-of-bounds write vulnerability (CWE-787) that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file. The CVSS 3.1 score is 8.8, with network attack vector, low complexity, no privileges, and user interaction required.
Per the affected data in the NVD record, versions up to and including 154.0.4258.37 are affected, and version 154.0.4258.48 is listed as unaffected. No other fixed version is claimed here; the update guide linked above is the reference for the update for your channel.
What to do
- Inventory Acrobat for Edge installations and note the version of each, including managed Edge deployments.
- Update installations in line with the Microsoft Security Update Guide entry for CVE-2026-100134; confirm your version against the affected range in the record rather than assuming an update applied.
- Remind users not to open unexpected PDF files while remediation is underway, and keep browser and PDF handling protections enabled.
- Hunt for Acrobat or Edge crashes and child processes spawned after opening PDF files from email, downloads, or shared drives.
- Verify the deployed version after updating, not just that an update ran.
Management note
PDF opening is routine office work, so a user-context code execution flaw in the Edge PDF path reaches every workstation that previews attachments. Push the update through managed channels and treat suspect PDFs opened before patching as endpoint triage.