{"id":"CVE-2026-100134","kind":"vulnerability","aliases":["CVE-2026-100134"],"related":[],"title":"Acrobat for Edge: out-of-bounds write lets a malicious file run code","description":"Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Acrobat for Edge (the Adobe PDF viewer built into Microsoft Edge) has an out-of-bounds write (CWE-787) that runs code as the current user when a victim opens a malicious file. Edge builds up to 154.0.4258.37 are affected; 154.0.4258.48 is fixed. No known exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Acrobat for Edge","fixed":["154.0.4258.48"],"affected":"<= 154.0.4258.37","ecosystem":"vendor"}],"ecosystems":[],"tags":["acrobat-for-edge","microsoft-edge","other","pdf","windows"],"not_affected_if":["edge-154.0.4258.48-or-later","no-acrobat-for-edge-installed"],"how_to_check":"Open edge://version and read the Edge version. If it is 154.0.4258.37 or lower, you are exposed. Check for Acrobat for Edge on Windows.","fix":"Update Microsoft Edge to 154.0.4258.48 or later (edge://settings/help), then restart the browser.","status":"open","published_at":"2026-10-20T19:17:11+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:32:47+00:00","updated_at":"2026-10-24T00:12:39+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:32:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Acrobat for Edge: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Acrobat for Edge has an out-of-bounds write flaw that can execute arbitrary code as the current user. A victim must open a malicious file for the attack to work.","category":"other","who_cares":["acrobat-for-edge","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary code runs as the current user after opening a file","analyst_note":"Sources give no affected or fixed versions and no vendor advisory link; check the Adobe security bulletin for Acrobat for Edge patch versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-acrobat-for-edge-installed"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000449,"input_tokens":2888,"output_tokens":321,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected or fixed versions and no vendor advisory link; check the Adobe security bulletin for Acrobat for Edge patch versions.","search":"'-100134':17A,20A '-2026':16A,19A '-787':53B '154.0.4258.37':72B '154.0.4258.48':75B 'acrobat':1A,21A,25B,34B,81C 'acrobat-for-edg':24B 'adob':38B 'affect':74B,85C 'arbitrari':98C 'bound':7A,50B,91C 'build':69B 'built':41B 'code':14A,56B,99C 'context':103C 'could':95C 'current':59B,106C 'cve':15A,18A 'cwe':52B 'edg':3A,27B,30B,36B,44B,68B,83C 'edge':23A 'execut':100C 'exploit':80B,108C 'file':12A,67B,123C 'fix':77B 'for':22A 'interact':114C 'issu':111C 'known':79B 'let':9A 'malici':11A,66B,122C 'microsoft':29B,43B 'microsoft-edg':28B 'must':119C 'open':64B,120C 'out-of-bound':4A,47B,88C 'pdf':32B,39B 'requir':112C 'result':96C 'run':13A,55B 'user':60B,107C,113C 'victim':63B,118C 'viewer':40B 'vulner':93C 'window':33B 'write':8A,51B,92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T19:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100134","severity":null,"published_at":"2026-10-20T19:17:11+00:00","modified_at":"2026-10-21T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-100134:609","url":null,"severity":null,"published_at":"2026-10-24T00:12:39+00:00","modified_at":"2026-10-24T00:12:39+00:00","first_seen_at":"2026-10-24T00:12:39+00:00","fetched_at":"2026-10-24T00:12:39+00:00","note":"CVE.org record (Adobe CNA) gives affected through 154.0.4258.37, fixed 154.0.4258.48; MSRC page is JS-only so not read directly. No exploitation or PoC found (VulDB: no exploit; KEV false). No X search done."}],"documents":[{"id":2476,"url":"https://www.cve.org/CVERecord?id=CVE-2026-100134","title":"CVE Record: CVE-2026-100134 (CNA record, affected through 154.0.4258.37, fixed 154.0.4258.48)","kind":"advisory","source":"analyst","text":"Acrobat for Edge out-of-bounds write (CWE-787), CVSS 3.1 8.8 AV:N/AC:L/PR:N/UI:R. Affected from 0 through 154.0.4258.37; unaffected at 154.0.4258.48. Reference: MSRC update guide (vendor-advisory).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2479,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100134","title":"MSRC Security Update Guide: CVE-2026-100134 (JS-only page)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}