Adobe released a security update (APSB26-43) to address CVE-2026-34621, a critical zero-day vulnerability in Adobe Acrobat and Reader. Flaw lies in an improperly Controlled Modification of Object Prototype Attributes within the embedded JavaScript engine, has been exploited in the wild since at least November.
Attackers utilise specially crafted PDF documents to bypass sandbox restrictions, execute privileged APIs, and achieve arbitrary code execution (ACE) on Windows and macOS systems.
Initial Vector: The victim receives a phishing email or encounters a watering hole containing a malicious PDF
Prototype Pollution: Upon opening the PDF, the heavily obfuscated JavaScript executes. Due to insufficient input validation, the script pollutes the Object.prototype, allowing the attacker to inject properties that propagate globally throughout the application.
Privileged API Access: The polluted state allows untrusted JavaScript to invoke privileged Acrobat APIs that are normally restricted. Key functions abused include:
System Fingerprinting: The exploit silently gathers system metadata (OS version, language, Reader version, and file paths) and transmits it to attacker infrastructure.
