EUVD-2026-74204
GHSA-48q3-3jc4-wq7c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
AV:L because exploitation requires the victim to open a local file; I:N because the described impact is read-only filesystem access, contradicting the vendor's I:H rating.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim must open a malicious PDF file in an affected version of Adobe Acrobat or Acrobat Reader (≤26.002.21900 for the current branch; ≤24.001.30383 for Acrobat 2024). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.2 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) is broadly consistent with a sandbox escape that reads sensitive filesystem content, though the I:H integrity metric appears overstated relative to the vendor's own description of 'arbitrary file system read' - write capability is nowhere stated, and this discrepancy should be verified against the APSB26-141 advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory APSB26-141 at https://helpx.adobe.com/security/products/acrobat/apsb26-141.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, alert all users to avoid opening PDFs from untrusted sources; no public exploit has been identified at time of analysis, but the low attack complexity elevates near-term risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today