Acrobat Reader CVE-2026-34622

The victim must open a malicious PDF file in Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362, or earlier. No special configuration required; default installations are affected.

Real-world risk is elevated but bounded by user interaction requirements. The CVSS 8.6 score reflects high severity due to complete confidentiality, integrity, and availability impact with scope change, but the local attack vector (AV:L) and required user interaction (UI:R) impose practical barriers. Attack complexity is low (AC:L) and no privileges are required (PR:N), meaning any user who opens a weaponized PDF triggers exploitation. No public exploit identified at time of analysis, reducing immediate risk compared to vulnerabilities with available POC code. EPSS probability data not provided in input, preventing quantitative exploitation likelihood assessment. SSVC decision framework considerations: exploitation status is POC-public (not confirmed), automatable is no due to UI:R dependency, technical impact is total (RCE with scope change). This profiles as a deliver-and-wait social engineering threat rather than wormable or scanner-exploitable. Priority should focus on environments with high PDF exposure (legal, finance, government) where users routinely open external documents. The scope change elevates risk above typical sandboxed reader vulnerabilities, as successful exploitation can pivot beyond the PDF rendering process.

An attacker crafts a malicious PDF document embedding JavaScript code designed to pollute Object.prototype with executable properties. The weaponized PDF is distributed via phishing email, malicious website download, or USB drop targeting the victim organization. When the victim opens the PDF in vulnerable Acrobat Reader versions, the embedded JavaScript executes within the reader's scripting engine, polluting prototype chains and injecting attacker-controlled code. Because the vulnerability enables scope change (S:C in CVSS), the exploit breaks out of the PDF sandbox and executes arbitrary code in the context of the logged-in user, achieving full system compromise if the user has administrative privileges. The attacker can then install backdoors, exfiltrate sensitive documents, or pivot to network resources accessible to the compromised user account.