CVE-2026-5939 — Code Execution

title: CVE-2026-5939 - Malicious XFA PDF Processing
id: scw-2026-04-27-ai-1
status: experimental
level: high
description: |
  Detects the execution of Adobe Reader (AcroRd32.exe) processing a PDF that triggers a calculate event, which is the vector for CVE-2026-5939. This rule specifically looks for the 'calculate' keyword within the command line arguments when Adobe Reader is both the parent and child process, indicating potential XFA form calculation that could lead to a use-after-free vulnerability and code execution.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-5939/
tags:
  - attack.execution
  - attack.t1203
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - 'AcroRd32.exe'
      ParentImage|endswith:
          - 'AcroRd32.exe'
      CommandLine|contains:
          - 'calculate'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse