Adobe Patches Reader Zero-Day Exploited for Months

Four-Month Zero-Day Window Closed in Adobe Reader

Adobe has released an emergency security bulletin to patch CVE-2026-34621, a critical vulnerability in Adobe Acrobat Reader that threat actors exploited in the wild for roughly four months before a fix was available. The flaw, discovered by researcher Haifei Li of EXPMON, received a CVSS score of 8.6 and was initially detected through sandbox behavioural analysis — not signature-based detection. At the time of discovery, only 13 of 64 antivirus engines on VirusTotal flagged the malicious PDF samples.

Technical Details: Prototype Pollution to RCE

Unlike a typical memory corruption flaw, CVE-2026-34621 is a prototype pollution vulnerability (CWE-1321) residing in Acrobat Reader's JavaScript engine.

Prototype pollution attacks modify Object.prototype in JavaScript, influencing the runtime behaviour of the entire application. In this case, the corruption allowed attackers to reach privileged Acrobat APIs — specifically util.readFileIntoStream() — enabling:

• Arbitrary local file reads — exfiltrating sensitive files without user interaction beyond opening the PDF
• Remote code execution — executing shellcode in the context of the Acrobat Reader process
• Sandbox escape — bypassing Acrobat's Protected Mode to affect the underlying OS

The attack requires only that the victim open a specially crafted PDF. No macros, no follow-up clicks.

Exploitation Campaign: Oil & Gas Industry Targeting

Security researchers identified that the malicious PDF lure documents contained Russian-language content related to the oil and gas industry, suggesting a targeted campaign against that sector. The targeting profile is consistent with financially motivated or state-aligned threat actors focused on energy sector espionage or sabotage preparation.

Exploitation began no later than December 2025, meaning attackers had a viable zero-day for approximately four months. During this window, the campaign evaded most detection tooling — consistent with a threat actor operating with operational security discipline.

Exploitation Timeline

Dec 2025   → Earliest confirmed exploitation in the wild
            → Malicious PDFs distributed via targeted phishing
            → EXPMON sandbox detects anomalous PDF behaviour
Jan–Mar 2026 → Active exploitation continues undetected by most AV
Apr 11, 2026 → Adobe releases APSB26-43 (Priority 1 patch)
Apr 12, 2026 → SecurityWeek, THN, Security Affairs publish details

Patching and Mitigation

Adobe rates this bulletin Priority 1, its highest urgency level, indicating active exploitation. Organizations and individuals should treat this as an emergency patch.

Immediate Steps

1. Update Acrobat Reader now — open Acrobat Reader → Help → Check for Updates → install 26.001.21411 or later
2. Enterprise deployment — use AIP-GPO or SCCM (Windows) / Apple Remote Desktop or SSH (macOS) for fleet patching
3. Enable Protected Mode — Acrobat's sandbox (Edit → Preferences → Security (Enhanced) → Enable Protected Mode at Startup)

Detection and Forensics

• Review email gateway logs for unexpected PDF attachments delivered since December 2025
• Query EDR telemetry for Acrobat Reader spawning child processes or making unexpected outbound connections
• Hunt for util.readFileIntoStream API calls in JavaScript-enabled PDF readers
• Check for modified Object.prototype in Acrobat's JavaScript sandbox logs if available

Organizational Controls

• Block or quarantine PDFs from untrusted senders at the mail gateway until all endpoints are patched
• Enable sandboxing across the fleet as a defence-in-depth measure — this may not fully prevent exploitation but limits blast radius
• Audit systems that received PDFs from external sources during the four-month exposure window

Why Prototype Pollution Matters

Prototype pollution is increasingly common in JavaScript-heavy applications. Because Object.prototype is inherited by virtually every JavaScript object, a single mutation can cascade through an entire application. The same class of bug has historically affected Node.js applications, web frameworks, and now native apps with embedded JavaScript engines like Adobe Acrobat.

The discovery of this flaw inside Acrobat Reader's engine — not a web browser — signals that desktop applications with scripting runtimes represent an underappreciated attack surface for this technique.

References

• SecurityWeek — Adobe Patches Reader Zero-Day Exploited for Months
• The Hacker News — Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
• Adobe Security Bulletin APSB26-43
• CISA Known Exploited Vulnerabilities Catalog