Acrobat Reader CVE-2026-34626

The CVSS 6.3 (Medium-High) score reflects a local attack vector with low complexity and user interaction required, but with high confidentiality impact and scope change. The EPSS exploitation probability is not provided, limiting probabilistic assessment. The attack vector (AV:L) and requirement for user interaction (UI:R) significantly constrain real-world risk compared to network-based vectors. However, the absence of published exploit code (no POC confirmed in input) and no CISA KEV listing indicate this is not yet actively exploited in the wild, despite theoretical feasibility. The vulnerability class (prototype pollution) is well-understood by security researchers, making POC development straightforward once details emerge. For end-users, risk depends on document ingestion workflows: organizations processing untrusted PDFs face elevated risk, while casual users face lower immediate threat. The high confidentiality impact (C:H) means successful exploitation could exfiltrate sensitive files accessible to the user account, making this a legitimate priority for patching despite the interaction requirement.

An attacker crafts a malicious PDF document containing JavaScript code that exploits the prototype pollution vulnerability to access the file system. When a victim opens the PDF in Acrobat Reader, the embedded script executes and modifies the prototype chain to gain unauthorized read access to sensitive files such as credentials, configuration files, or user documents stored on the local system. The attacker could exfiltrate these files by embedding them in HTTP callbacks or writing them to accessible directories.