CVE-2026-47937 is an Uncontrolled Search Path Element vulnerability in Adobe Acrobat Reader that affects versions up to 24.001.30365 and 26.001.21651. This vulnerability allows an attacker with high privileges to execute arbitrary code by exploiting the way the application handles search paths when opening files. Exploitation requires user interaction, specifically opening a malicious file, and the scope of impact is changed, affecting the current user's context. The CVSS v3.1 base score is 7.7, indicating high severity with attack vector local, low attack complexity, high privileges required, and user interaction needed.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. The attacker must have high privileges and rely on user interaction to open a crafted malicious file. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources, especially if running Acrobat Reader versions up to 24.001.30365 or 26.001.21651. Monitor Adobe's security advisories for updates and apply patches promptly once released.