What is the CVSS score of CVE-2026-34626?

CVE-2026-34626 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Prototype Pollution CVE-2026-34626

EUVD-2026-22337 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-04-14 adobe

GHSA-m5xm-mx43-q65f

Prototype Pollution Adobe Information Disclosure

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 18:48 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:00 euvd

EUVD-2026-22337

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

CVE Published

Apr 14, 2026 - 16:18 nvd

MEDIUM 6.3

DescriptionCVE.org

Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary file system read in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Prototype pollution in Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier allows arbitrary file system read operations in the context of the current user when a victim opens a malicious PDF or document. The vulnerability requires user interaction but enables confidentiality compromise with high impact; no active exploitation confirmed but the attack surface is broad given Acrobat Reader's ubiquity in document handling.

Technical ContextAI

The vulnerability stems from improper handling of object prototype attributes (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes), a class of flaw in JavaScript and similar interpreted environments where attacker-controlled input can pollute the prototype chain of built-in objects. In Adobe Acrobat Reader's document processing engine, this allows manipulation of inherited properties and methods, leading to unintended file system access. The affected CPE cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* encompasses all Acrobat Reader versions, with confirmed vulnerable versions ranging from 0 through 24.001.30362, including the extended support releases (24.x) and the current version line (26.x). The prototype pollution occurs during parsing or scripting execution within embedded JavaScript contexts in PDF documents.

RemediationAI

Apply the patched version released by Adobe as documented in APSB26-44 security bulletin (https://helpx.adobe.com/security/products/acrobat/apsb26-44.html); the advisory specifies fixed versions for both the 24.x extended support release line and the 26.x current release line. Users should update Acrobat Reader immediately through Adobe's automatic update mechanism or manual download from adobe.com. As an interim mitigation, disable JavaScript execution in Acrobat Reader preferences (Edit > Preferences > Security) and exercise caution when opening PDFs from untrusted sources, particularly those received via email or from external websites. Organizations should enforce update deployment through centralized patch management systems.