Adobe rushes patch for Reader flaw

Adobe has issued an emergency update for Acrobat and Reader after confirming that a zero-day vulnerability tracked as CVE-2026-34621 is being exploited in the wild, putting Windows and macOS users on notice to install the patch quickly. The company assigned the update a Priority 1 rating, its most urgent category for product security bulletins, and said successful exploitation could lead to arbitrary code execution. The flaw affects Acrobat DC, Acrobat Reader DC and Acrobat 2024 builds before the newly released patched versions.

According to Adobe’s bulletin, the issue stems from “improperly controlled modification of object prototype attributes”, more widely known as prototype pollution. Adobe listed affected versions as 26.001.21367 and earlier for Acrobat DC and Acrobat Reader DC, and 24.001.30356 and earlier for Acrobat 2024. The company said users should move to version 26.001.21411 on the DC track, while Acrobat 2024 users should update to 24.001.30362 on Windows and 24.001.30360 on macOS. Adobe also credited Haifei Li of EXPMON with reporting the vulnerability.

The chronology matters because Adobe’s handling of the flaw changed over the course of the weekend. In the revised bulletin, the company kept the vulnerability classed as critical in impact because it can enable arbitrary code execution, but adjusted its CVSS vector after clarifying that exploitation requires a victim to open a malicious file locally. That change lowered the published score from 9.6 to 8.6, reflecting a local rather than network attack vector, without easing the practical urgency of patching for users who routinely receive PDFs from outside parties.

Independent security researchers say the attacks appear to have begun months before the vendor patch arrived. Sophos said a researcher described the zero-day on April 7 and linked exploitation to activity dating back to at least December 2025, while SecurityWeek reported analysis suggesting samples may have appeared as early as November 2025. The reported attack chain relied on specially crafted PDF files containing obfuscated JavaScript, allowing the malicious document to invoke privileged Acrobat APIs, gather information from the victim system and potentially prepare the ground for follow-on activity, including remote code execution.

That pattern underlines why Acrobat and Reader remain attractive targets. PDF files still sit at the centre of business communication, legal workflows, invoices, compliance exchanges and document archiving, which makes them an effective delivery vehicle for attackers seeking high open rates with low suspicion. In this case, the available reporting suggests the malicious files used language and topical lures tailored to intended victims, including Russia-focused oil and gas themes. Even though exploitation requires user interaction, the threshold is low: opening what appears to be a routine document can be enough to trigger the attack.

For corporate defenders, the Adobe advisory points to a familiar but costly problem: patching document software tends to rank below browsers, operating systems and network tools, even though it is embedded deeply across enterprise environments. Priority 1 status means the vendor views the risk as immediate and likely to affect a broad user base, especially where the product is widely deployed. Managed environments can roll out the fix through standard enterprise update channels, while individual users can update through the application’s built-in “Check for Updates” function or automatic updates, depending on configuration.