EUVD-2026-21675
GHSA-vcqh-932g-m3qj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver weaponized PDF via email/web download
-
DeliveryUser opens document in vulnerable Reader
-
ExploitJavaScript engine processes prototype pollution payload
-
ExecutionPolluted properties trigger during legitimate operations
-
PersistArbitrary code executes in user context
-
ImpactAttacker establishes persistence or deploys secondary payloads
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must open a malicious PDF or related file in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367, or earlier. No authentication required. Attacker delivers crafted file via email or web download; user interaction (opening file) is required for exploitation. |
| Impact | CVSS 9.6 severity reflects worst-case technical impact: network attack vector (AV:N) with low complexity (AC:L), no authentication required (PR:N), scope change (S:C), and complete confidentiality/integrity/availability loss. However, mandatory user interaction (UI:R) creates friction in exploitation chains. EPSS 0.24% probability at 46th percentile suggests mid-tier exploitation likelihood compared to the broader CVE landscape-not negligible but not attracting intense attacker focus. SSVC decision factors: exploitation status shows no public exploit identified at time of analysis; automatable is NO due to user interaction requirement; technical impact is TOTAL (arbitrary code execution). This is a real priority for organizations using Adobe Reader at scale, particularly in email-heavy environments where PDF delivery is routine, but the exploitation barrier and moderate EPSS reduce urgency compared to authentication-bypass or wormable vulnerabilities. Confirmed actively exploited (CISA KEV) status would elevate this to immediate patching priority; current signals suggest prioritize for scheduled deployment cycles within 30 days. |
| Exploit ScenarioDerived | Attacker crafts a malicious PDF file embedding JavaScript that pollutes Object.prototype with executable properties. When distributed via email phishing campaign targeting enterprise users, victim opens the PDF in vulnerable Acrobat Reader. During document load, Reader's JavaScript engine processes the polluted prototype, causing subsequent legitimate operations to reference attacker-controlled properties. This triggers arbitrary code execution with the privilege level of the logged-in user, enabling payload delivery (ransomware, credential theft tools, lateral movement agents). Attack complexity is low (AC:L) as prototype pollution techniques are well-documented and do not require sophisticated environmental preconditions beyond target opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis.
RemediationAI
Apply vendor-released patches from Adobe Security Bulletin APSB26-43 available at https://helpx.adobe.com/security/products/acrobat/apsb26-43.html. While the input data does not specify exact fixed versions, Adobe's standard patching cadence typically releases updates simultaneously with bulletin publication-consult APSB26-43 for platform-specific installers and fixed version numbers. Enterprise deployments should use centralized update mechanisms (Adobe Update Server, SCCM, Intune) to ensure coverage across endpoints. Interim risk reduction measures include: disable JavaScript execution in Acrobat Reader preferences (Edit > Preferences > JavaScript > uncheck 'Enable Acrobat JavaScript'), though this may break legitimate PDF form functionality; implement email gateway filtering to block PDF attachments from untrusted sources; educate users on PDF phishing risks and suspicious document indicators (unexpected macro prompts, external resource loads). Protected View mode (if available in affected versions) provides sandboxing for untrusted documents but should not replace patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits CWE-1321 (Prototype Pollution), a class of attack where attackers modify JavaScript object prototypes in runtime environments. Adobe Acrobat Reader embeds JavaScript engines for PDF interactivity (form validation, calculations, document actions). By injecting malicious properties into Object.prototype or other built-in prototypes through specially crafted PDF JavaScript, attackers can alter application behavior globally. When legitimate code accesses polluted properties, the injected values trigger unintended execution paths. Affected versions span Acrobat Reader 24.001.30356, 26.001.21367 and all earlier releases (per EUVD data confirming versions 0 through 26.001.21367). The scope change (S:C) in CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component's security scope, consistent with JavaScript prototype chains influencing application-wide execution contexts.
Know when Acrobat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
4DescriptionCVE.org
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Articles & Coverage 1
Executive ViewAI
Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier contain a critical prototype pollution vulnerability (CVSS 9.6) that enables unauthenticated remote code execution when users open malicious PDF files. This affects any organization where employees receive or process PDF documents, creating immediate risk of data theft, system compromise, and potential lateral movement across the network. Leadership must treat this as an active threat requiring urgent containment measures until Adobe releases a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable Adobe Reader as default PDF handler; substitute with alternative PDF viewers (e.g., Windows Edge PDF reader, Firefox) that do not contain this vulnerability; (2) Block PDF attachments in email gateways; (3) Implement application whitelisting to prevent unsigned code execution; (4) Disable JavaScript execution in Adobe Reader via Group Policy or preferences; (5) Require administrator approval before opening PDFs from external sources; (6) Monitor for exploitation attempts targeting prototype pollution techniques in network traffic. These controls reduce but do not eliminate risk-patch application is mandatory upon availability.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Exploit-DB