Adobe Rushes Out Acrobat Reader Patch for Zero-Day Exploited Since December
Adobe says CVE-2026-34621 is under active exploitation in Acrobat and Reader; the flaw can lead to arbitrary code execution and prompted a CISA KEV deadline.
Overview
Adobe released an emergency security update on April 11 for Acrobat and Reader on Windows and macOS to fix CVE-2026-34621, a critical prototype-pollution vulnerability that Adobe says can lead to arbitrary code execution and is already being exploited in the wild, according to Adobe’s bulletin.
The patch applies to Acrobat DC, Acrobat Reader DC, and Acrobat 2024, with Adobe listing fixed builds for each product and recommending that users update to the newest version, according to Adobe’s bulletin.
What We Know
Security researcher Haifei Li of EXPMON said the exploit had been active since at least December 2025 and worked by opening a malicious PDF, which could bypass Acrobat’s sandbox and invoke privileged JavaScript APIs, according to BleepingComputer.
BleepingComputer reported that the observed attack chain used APIs such as util.readFileIntoStream() and RSS.addFeed() to read local files, exfiltrate data, and fetch additional attacker-controlled code, which makes this look less like a simple document bug and more like a direct path from PDF delivery to data theft and code execution, according to BleepingComputer.
The Hacker News reported that Adobe revised the bulletin on April 12, changing the CVSS score from 9.6 to 8.6 after adjusting the attack vector from network to local, and said CISA added CVE-2026-34621 to its Known Exploited Vulnerabilities catalog on April 13 with a remediation deadline of April 27 for federal civilian agencies, according to The Hacker News.
What We Don’t Know
Public reporting has not identified the actor behind the exploitation or how many victims have been affected, according to The Hacker News.
It is also not yet clear whether the activity is concentrated in a specific region or campaign set, although the current reporting is enough to show that this bug was being used in the wild before Adobe pushed the fix, according to Adobe’s bulletin.
Analysis
This is another reminder that PDF readers remain durable attack surfaces because they combine document parsing, scripting, sandbox boundaries, and file-access APIs in a product class users still trust by default. That is an inference from Adobe’s code-execution warning and the exploit behavior described by BleepingComputer.
For defenders, the immediate priority is straightforward: deploy the Acrobat and Reader update, especially on systems that handle external documents or sit inside higher-risk workflows, because Adobe has already said the flaw is being exploited in the wild, according to Adobe’s bulletin.