What is the CVSS score of EUVD-2026-22335?

EUVD-2026-22335 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Prototype Pollution are affected by EUVD-2026-22335?

CVE-2026-34622 is a high-severity prototype pollution vulnerability in Adobe Acrobat Reader that enables arbitrary code execution when users open crafted PDF files, affecting versions through…

How to fix or mitigate EUVD-2026-22335?

Within 24 hours: inventory all systems running Adobe Acrobat Reader versions 26.001.21411 or earlier, 24.001.30360, or 24.001.30362; restrict end-user opening of PDFs from untrusted sources pending remediation. Within 7 days: monitor Adobe security advisories (APSB26-44) for patch release and testing in isolated environments; communicate patch timeline to end users and management. Within 30 days: deploy vendor-released patch to all affected Acrobat Reader instances; validate deployment across asset inventory and confirm version compliance.

Prototype Pollution EUVD-2026-22335

| CVE-2026-34622 HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-04-14 adobe

GHSA-qf67-wfx4-7jww

Prototype Pollution Adobe RCE

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 18:49 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:00 euvd

EUVD-2026-22335

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

CVE Published

Apr 14, 2026 - 16:18 nvd

HIGH 8.6

DescriptionCVE.org

Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Prototype pollution in Adobe Acrobat Reader allows arbitrary code execution when victims open malicious PDF files. Affects Acrobat Reader versions through 26.001.21411, 24.001.30360, and 24.001.30362. Attack requires local file access with user interaction (CVSS AV:L/UI:R) but achieves scope change and full CIA impact (S:C/C:H/I:H/A:H), yielding CVSS 8.6. No public exploit identified at time of analysis. Vendor advisory available from Adobe (APSB26-44). EPSS data not provided; exploitation status limited to user-interaction-dependent local attack vector.

Technical ContextAI

This vulnerability stems from CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly known as prototype pollution. In JavaScript-based applications like PDF readers with embedded scripting engines, prototype pollution occurs when an attacker can inject properties into base object prototypes (e.g., Object.prototype), causing all subsequently created objects to inherit malicious properties. Adobe Acrobat Reader incorporates a JavaScript engine for interactive PDF features, forms, and automation. By crafting PDF files with malicious JavaScript that manipulates prototype chains, attackers can override built-in methods or inject executable payloads. The CPE identifier cpe:2.3:a:adobe:acrobat_reader indicates all Adobe Acrobat Reader products are in scope. The CVSS scope change (S:C) suggests the vulnerability can break out of the application's normal security context, potentially affecting the underlying operating system or other processes running under the victim's user account.

RemediationAI

Apply the vendor-released patch by upgrading Adobe Acrobat Reader to the versions specified in Adobe Security Bulletin APSB26-44 available at https://helpx.adobe.com/security/products/acrobat/apsb26-44.html. Adobe typically releases patches for both continuous and classic tracks simultaneously; consult the bulletin for exact fixed version numbers for each track (specific fix versions not provided in source data). For continuous track users, upgrade to the latest version post-26.001.21411; for classic track users, upgrade beyond 24.001.30362. Until patching is complete, implement defense-in-depth controls: restrict PDF sources to trusted domains, disable JavaScript execution in Acrobat Reader preferences (Edit → Preferences → JavaScript → uncheck Enable JavaScript), use email gateway sandboxing to detonate suspicious PDFs, and educate users on social engineering risks. Organizations may consider alternative PDF readers without JavaScript engines for users who do not require interactive PDF features. Verify successful patching by checking Help → About Adobe Acrobat Reader to confirm version post-remediation.