CVE-2016-1090: Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader...

Security readout for executives and security teams

CVE-2016-1090 is a local privilege escalation issue in older Adobe Reader and Acrobat releases. A local user could abuse an untrusted search path to make the application load a malicious resource from an unspecified directory. Sources do not show remote exploitation or active exploitation. Exposure is most likely on legacy Windows or OS X endpoints still running the affected Adobe Reader or Acrobat versions. Current supported Acrobat or Reader deployments should be checked against Adobe's APSB16-14 guidance, but the provided sources do not identify affected server products or cloud services. Prioritize this as legacy endpoint hygiene, especially where old Adobe desktop software remains installed. It is not supported by the provided sources as actively exploited, but it can matter in chained attacks where an attacker already has local user access. Mitigation focus: Upgrade Acrobat and Reader to the fixed versions in Adobe APSB16-14 or later.; Remove unsupported legacy Adobe Reader or Acrobat installations where possible.; Prioritize endpoints where users can execute untrusted local files..

Prepared

Jun 13, 2026, 14:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.