cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Adobe Patches Acrobat Zero-Day Exploited Through Malicious PDFs

· Original article ↗

Summary

Adobe patched CVE-2026-34621, a zero-day reportedly exploited since at least December. Malicious PDFs can bypass Acrobat’s sandbox and use privileged JavaScript APIs to read and exfiltrate local files; Adobe lists fixed versions.

Key points

  • CVE-2026-34621 was reportedly exploited in the wild since at least December.
  • Malicious PDFs can bypass sandbox restrictions and invoke privileged JavaScript APIs; the observed exploit requires opening the PDF but no further user interaction.
  • The exploit uses APIs including util.readFileIntoStream() and RSS.addFeed() to read local files and exfiltrate data.
  • Researcher Haifei Li discovered the issue while investigating a submitted PDF sample; researcher Gi7w0rm reported attacks using Russian-language oil and gas industry lures.
  • Affected versions include Acrobat DC and Reader DC 26.001.21367 and earlier, and Acrobat 2024 24.001.30356 and earlier.
  • Adobe released fixes in Acrobat DC and Reader DC 26.001.21411, Acrobat 2024 24.001.30362 for Windows, and 24.001.30360 for Mac.
  • Adobe listed no workaround; applying the updates is the recommended action.

Article Details

Vulnerability Types
  • Sandbox bypass
  • Arbitrary local file read
  • Potential arbitrary code execution
Severity
8.6; Adobe initially rated the vulnerability 9.6, then lowered it after changing the attack vector to local.
Affected Versions
  • Acrobat DC 26.001.21367 and earlier
  • Acrobat Reader DC 26.001.21367 and earlier
  • Acrobat 2024 24.001.30356 and earlier
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1005 · Data from Local SystemThe exploit uses privileged JavaScript APIs, including util.readFileIntoStream(), to read arbitrary local files.T1203 · Exploitation for Client ExecutionThe exploit is delivered in a malicious PDF and triggers when the victim opens it, without further interaction.T1211 · Exploitation for StealthThe exploit bypasses Acrobat and Acrobat Reader sandbox restrictions.

CVE

CVE-2026-34621Adobe · Acrobat 2024; Adobe · Acrobat DC; +1 moreAdobe released an emergency update for Acrobat and Acrobat Reader to fix CVE-2026-34621, a zero-day exploited since at least December that lets malicious PDFs bypass sandboxing and invoke privileged JavaScript APIs.

People

Gi7w0rmSpotted attacks in the wild that used Russian-language documents with oil and gas industry lures.Haifei LiDiscovered the vulnerability after investigating the submitted PDF sample and developed the Adobe Reader detection-in-depth capability used during the investigation.

Vendors

AdobeAdobe released an emergency update for Acrobat and Acrobat Reader to fix CVE-2026-34621, a zero-day exploited since at least December that lets malicious PDFs bypass sandboxing and invoke privileged JavaScript APIs.

Products

Acrobat 2024Acrobat 2024 versions 24.001.30356 and earlier (fixed in version 24.001.30362 on Windows, and version 24.001.30360 on Mac)Acrobat DCAcrobat DC versions 26.001.21367 and earlier (fixed in version 26.001.21411)Acrobat Reader DCAcrobat Reader DC versions 26.001.21367 and earlier (fixed in version 26.001.21411)

Tools

ExpmonResearcher Haifei Li of EXPMON discovered the issue after analyzing a sample named “yummy_adobe_exploit_uwu.pdf”.

Industries

Oil and gasSecurity researcher Gi7w0rm spotted attacks in the wild that leveraged Russian-language documents with oil and gas industry lures.

Related Articles