CVE-2026-34621
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
Adobe·Acrobat and Reader
- Added
- Apr 13, 2026
- Fix due
- Apr 27, 2026
- Ransomware
- Not known
- Published
- Apr 11, 2026
- Updated
- Aug 27, 2026
- First covered
- Jul 6, 2026
- Latest story
- 4 months ago
Summary
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
Attack profile
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Adobe Acrobat DCup to 26.001.21367
- Adobe Acrobat Reader DCup to 26.001.21367
- Adobe Acrobat 2024up to 24.001.30356