CVE-2026-34621

Name of the Vulnerable Software and Affected Versions Acrobat DC versions prior to 26.001.21411 Acrobat Reader DC versions prior to 26.001.21411 Acrobat 2024 (affected versions not specified)

Description An Improperly Controlled Modification of Object Prototype Attributes, known as Prototype Pollution, exists in the JavaScript engine of Adobe Acrobat and Reader. This flaw occurs due to insecure handling of object properties in privileged APIs, specifically the util.readFileIntoStream() function, which allows an attacker to pollute the base Object.prototype and redirect the execution flow of the process. Additionally, the RSS.addFeed() API has been repurposed as a bidirectional command and control channel to exfiltrate sensitive data—such as local documents, credentials, and SSH keys—and receive additional malicious JavaScript payloads. Exploitation requires a victim to open a specially crafted PDF file and can lead to arbitrary code execution and full system takeover with the privileges of the current user. This issue has been actively exploited by APT groups since December 2025, targeting approximately 600 million active installations worldwide.

Recommendations Update Acrobat DC and Acrobat Reader DC to versions 26.001.21411 or later. As a temporary workaround, disable JavaScript by navigating to Preferences > JavaScript and unchecking Enable Acrobat JavaScript. Restrict the use of the util.readFileIntoStream() function and monitor for unauthorized calls to this API in PDF files.