Acrobat Reader Flaw Could Lead to Code Execution

The National Vulnerability Database (NVD) has highlighted a critical vulnerability, CVE-2026-34622, impacting several versions of Adobe Acrobat Reader. According to NVD, this flaw stems from an ‘Improperly Controlled Modification of Object Prototype Attributes’ issue, commonly known as Prototype Pollution. This type of vulnerability can be particularly nasty, potentially allowing attackers to execute arbitrary code within the user’s current context.

The CVSS score for this vulnerability is a high 8.6, underscoring its severity. Exploitation, however, isn’t straightforward. NVD notes that it requires a user to interact with a malicious file, likely by opening a specially crafted document. This means social engineering or phishing tactics could be the initial vector for attackers looking to leverage this flaw.

While specific affected products beyond Acrobat Reader versions 26.001.21411, 24.001.30360, and 24.001.30362 were not detailed, the underlying CWE-1321 classification points to a common weakness in how JavaScript objects are handled. Users and organizations relying on these Adobe products should prioritize patching and remain vigilant against suspicious file attachments.