Adobe Acrobat Reader EUVD-2026-74105

Exploitation requires all of the following simultaneously: (1) the attacker already holds high privileges on the local system (PR:H - this is not an unauthenticated or low-privilege attack vector); (2) specific environmental conditions beyond the attacker's direct control must be satisfied, such as a particular Acrobat installation state, a writable directory present in the DLL search order, or an OS-level filesystem configuration (AC:H); (3) a victim must actively open a malicious file within the vulnerable Acrobat application (UI:R - passive or drive-by exploitation is not possible); and (4) the entire attack is strictly local (AV:L - remote exploitation is not possible without a separate initial-access mechanism). Limiting factors: the PR:H requirement means an opportunistic remote attacker cannot directly exploit this; AC:H means automated, reliable exploitation is not feasible; UI:R means exploitation cannot proceed without victim action; and C:H/I:N/A:N constrains impact to information disclosure only.

Real-world risk is moderate-to-low despite the 'privilege escalation' label in the description. The CVSS base score of 4.0 reflects a compound set of prerequisites: the attacker must already hold high privileges (PR:H), exploitation conditions must align without attacker control (AC:H), the attack surface is strictly local (AV:L), and a victim must open a crafted file (UI:R). These compounding constraints dramatically narrow the viable attacker population and preclude opportunistic or automated exploitation. Critically, the CVSS impact metrics C:H/I:N/A:N are inconsistent with conventional 'privilege escalation' expectations - privilege escalation typically implies an integrity or access-control boundary change (I:H), yet I:N is scored. This discrepancy suggests the 'privilege escalation' may describe access to confidential data readable only in an elevated context rather than a full administrative or code-execution gain; this distinction materially affects risk posture and should be confirmed against APSB26-141. No EPSS data, CISA KEV listing, or public exploit code is available, indicating no current active exploitation pressure. This vulnerability is unlikely to be a top-tier patching priority for most organizations but warrants attention in environments with strict data separation requirements where even elevated read access is unacceptable.

A local attacker already operating with high administrative privileges on a Windows endpoint plants a malicious DLL in a user-writable directory within Acrobat's DLL search path. When a victim opens a specially crafted PDF document, Acrobat resolves the untrusted search path and loads the attacker's library, granting the attacker read access to confidential data accessible only in the elevated execution context. No public proof-of-concept exploit code is known at time of analysis.