Product:
Acrobat Reader
Summary
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.6 | CVE-2026-34621 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim using the affected version of Acrobat Reader, triggers the prototype pollution. This allows the attacker to execute arbitrary code within the context of the current user, potentially leading to unauthorized access or control over the user’s system.
Affected Products
- Acrobat Reader versions 24.001.30356 and earlier
- Acrobat Reader versions 26.001.21367 and earlier
Mitigation
Users are advised to update their Acrobat Reader to the latest version to mitigate this vulnerability. Regularly applying security updates and avoiding opening untrusted files can also help reduce the risk of exploitation.