Adobe Patches Critical PDF Zero-Day Exploited Since November 2025
Key Takeaways
- CVE-2026-34621 is a critical prototype-pollution flaw in Acrobat/Reader exploited in the wild since November 2025.
- Adobe released an emergency patch for Acrobat/Reader on April 11, 2026.
- The flaw enables remote code execution via malicious PDFs, bypassing sandbox protections and JavaScript APIs.
Adobe PDF Zero-Day Exploit
Adobe patched a critical zero-day vulnerability in its PDF software that hackers had been actively exploiting since at least November 2025.
“Adobe has released an emergency security update for Acrobat Reader to fix a vulnerability, tracked as CVE-2026-34621, that has been exploited in zero-day attacks since at least December”
The flaw allowed attackers to execute arbitrary code simply by convincing users to open a specially crafted PDF file.
Security researcher Haifei Li discovered the vulnerability after someone uploaded a malicious PDF to his EXPMON detection system.
The exploit could lead to full control of the victim's system and was being used in the wild for at least four months before Adobe released a fix.
The vulnerability affected Acrobat DC, Reader DC, and Acrobat 2024 on both Windows and macOS.
Adobe urged users to update immediately as there were no workarounds or mitigations.
Exploit Mechanics and Targets
The vulnerability was an Improperly Controlled Modification of Object Prototype Attributes bug.
Exploitation required only that the victim open a malicious PDF file; no additional interaction was needed.
The malicious PDFs contained obfuscated JavaScript that could fingerprint the underlying system and send information to a command and control server.
Some documents were written in Russian and referenced oil and gas sector themes.
The exploit also abused APIs to read arbitrary local files and exfiltrate data.
Aftermath and Industry Impact
The five-month exploitation window represents one of the longest known zero-day windows in recent memory.
“Opening the wrong PDF in Adobe Reader was enough to let criminals quietly spy on your computer and unleash more attacks, even though everything looked normal”
Adobe's position as the default choice for document management faces pressure.
The incident raises uncomfortable questions about detection capabilities across the cybersecurity industry.
Organizations that processed PDF files from untrusted sources face the prospect of assuming compromise until proven otherwise.
More on Technology and Science
Elon Musk Demanda a Apple y OpenAI por Integrar ChatGPT y Bloquear la Competencia
19 sources compared
Anthropic Product Head Cat Wu Says Future AI Will Anticipate User Needs Before Prompts
10 sources compared
Notion Launches Custom Agents Public Beta, Automating Q&A, Routing, And Reporting Workflows
17 sources compared
Solar Impulse 2 Crashes Into Gulf Of Mexico During Autonomous Test Flight
10 sources compared