Acrobat EUVD-2026-21675

The victim must open a malicious PDF or related file in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367, or earlier. No authentication required. Attacker delivers crafted file via email or web download; user interaction (opening file) is required for exploitation.

CVSS 9.6 severity reflects worst-case technical impact: network attack vector (AV:N) with low complexity (AC:L), no authentication required (PR:N), scope change (S:C), and complete confidentiality/integrity/availability loss. However, mandatory user interaction (UI:R) creates friction in exploitation chains. EPSS 0.24% probability at 46th percentile suggests mid-tier exploitation likelihood compared to the broader CVE landscape-not negligible but not attracting intense attacker focus. SSVC decision factors: exploitation status shows no public exploit identified at time of analysis; automatable is NO due to user interaction requirement; technical impact is TOTAL (arbitrary code execution). This is a real priority for organizations using Adobe Reader at scale, particularly in email-heavy environments where PDF delivery is routine, but the exploitation barrier and moderate EPSS reduce urgency compared to authentication-bypass or wormable vulnerabilities. Confirmed actively exploited (CISA KEV) status would elevate this to immediate patching priority; current signals suggest prioritize for scheduled deployment cycles within 30 days.

Attacker crafts a malicious PDF file embedding JavaScript that pollutes Object.prototype with executable properties. When distributed via email phishing campaign targeting enterprise users, victim opens the PDF in vulnerable Acrobat Reader. During document load, Reader's JavaScript engine processes the polluted prototype, causing subsequent legitimate operations to reference attacker-controlled properties. This triggers arbitrary code execution with the privilege level of the logged-in user, enabling payload delivery (ransomware, credential theft tools, lateral movement agents). Attack complexity is low (AC:L) as prototype pollution techniques are well-documented and do not require sophisticated environmental preconditions beyond target opening the file.