Adobe Reader Zero-Day May Have Been Exploited Since November, Researcher Says
Summary
Researcher Haifei Li says a PDF exploit detected by Expmon may target a zero-day in the latest Adobe Reader. A sample submitted to VirusTotal in November 2025 suggests exploitation for at least four months; Adobe is assessing the report.
Key points
- Expmon detected a malicious PDF that Li believes exploits an Adobe Reader zero-day, including against the latest version.
- Li confirmed the PDF collects user and other system data, but could not reproduce the full attack chain.
- Possible follow-on sandbox escape and remote code execution payloads have not been obtained or confirmed.
- A sample submitted to VirusTotal in November 2025 suggests the vulnerability may have been exploited for at least four months.
- Reviewed PDFs reportedly used Russian-language lures referencing current events in Russia’s oil and gas sector.
- Adobe received the exploit details around April 7 and has not yet shared its assessment.
Article Details
- Vulnerability Types
- Zero-day vulnerability in Adobe Reader
- Severity
- Unknown
- Affected Versions
- Adobe Reader (latest version; exact version not specified)
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unknown