CVE-2026-34621: Adobe Acrobat DC RCE Vulnerability

CVE-2026-34621 Overview

CVE-2026-34621 is a Prototype Pollution vulnerability affecting Adobe Acrobat Reader that enables arbitrary code execution in the context of the current user. This vulnerability exists in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier, where improper control of object prototype attribute modifications allows attackers to manipulate JavaScript object prototypes within PDF documents, ultimately leading to code execution when a user opens a malicious file.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise.

Affected Products

• Adobe Acrobat DC (Continuous track) - versions prior to patched release
• Adobe Acrobat Reader DC (Continuous track) - versions 24.001.30356, 26.001.21367 and earlier
• Adobe Acrobat (Classic track) - affected versions on Windows and macOS

Discovery Timeline

• April 11, 2026 - CVE-2026-34621 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34621

Vulnerability Analysis

This vulnerability falls under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly known as Prototype Pollution. In JavaScript-based environments like Adobe Acrobat's PDF rendering engine, objects inherit properties from their prototypes. When an attacker can control the modification of prototype attributes, they can inject malicious properties that propagate to all objects inheriting from the polluted prototype.

The attack requires user interaction—specifically, the victim must open a specially crafted malicious PDF file. Once opened, the malicious JavaScript embedded within the PDF document exploits the prototype pollution flaw to achieve arbitrary code execution. The vulnerability affects both Windows and macOS platforms where Adobe Acrobat products are installed.

Root Cause

The root cause of CVE-2026-34621 lies in insufficient validation and sanitization of JavaScript object property assignments within Adobe Acrobat's JavaScript engine. When processing PDF documents containing JavaScript, the application fails to properly restrict modifications to the __proto__, constructor, or prototype properties of objects. This allows an attacker to inject arbitrary properties into the Object prototype, which then become available to all JavaScript objects within the execution context.

Attack Vector

The attack vector is local, requiring the victim to open a malicious PDF file. An attacker would typically deliver the malicious PDF through:

1. Phishing emails - Sending the malicious PDF as an attachment or via a download link
2. Compromised websites - Hosting the malicious PDF for download on legitimate-looking or compromised websites
3. Social engineering - Convincing users to download and open the file through various pretexts

Once the victim opens the malicious PDF in Adobe Acrobat Reader, the embedded JavaScript executes within the application's sandbox. The prototype pollution vulnerability allows the attacker to escape intended restrictions and execute arbitrary code with the privileges of the current user. Due to the scope change indicated in the vulnerability characteristics, successful exploitation could impact resources beyond the vulnerable component.

The vulnerability mechanism leverages JavaScript prototype pollution to manipulate object properties. When a PDF containing malicious JavaScript is opened, the script modifies the prototype chain of base JavaScript objects, injecting properties that can alter application behavior. This pollution propagates to subsequently created objects, allowing attackers to override critical functions or inject malicious callbacks that execute arbitrary code. For detailed technical analysis, refer to the Adobe Acrobat Security Advisory.

Detection Methods for CVE-2026-34621

Indicators of Compromise

• PDF files containing obfuscated JavaScript with references to __proto__, constructor.prototype, or Object.prototype property modifications
• Unexpected child processes spawned by Adobe Acrobat Reader or Acrobat DC applications
• Unusual network connections originating from Acrobat processes
• Suspicious PDF attachments received via email with JavaScript content

Detection Strategies

• Deploy endpoint detection rules to monitor for prototype pollution patterns in PDF JavaScript content
• Implement behavioral analysis to detect anomalous process creation by Adobe Acrobat applications
• Enable enhanced logging for PDF processing events and JavaScript execution within document readers
• Use YARA rules to scan incoming PDF files for known prototype pollution exploit patterns

Monitoring Recommendations

• Monitor process trees for unexpected child processes spawned by AcroRd32.exe, Acrobat.exe, or their macOS equivalents
• Enable Windows Event Logging for process creation events (Event ID 4688) and correlate with Adobe process activity
• Implement file integrity monitoring on critical system files that could be modified post-exploitation
• Deploy network monitoring to detect command-and-control communications from compromised Acrobat processes

How to Mitigate CVE-2026-34621

Immediate Actions Required

• Update Adobe Acrobat and Adobe Acrobat Reader to the latest patched versions immediately
• Block or quarantine suspicious PDF files at email gateways and web proxies pending updates
• Enable Protected View and disable JavaScript execution in Adobe Acrobat Reader as a temporary measure
• Review and audit systems for indicators of compromise if exploitation is suspected

Patch Information

Adobe has released security updates to address this vulnerability as documented in security bulletin APSB26-43. Organizations should prioritize patching given the active exploitation status and inclusion in the CISA KEV catalog. The patch addresses the improper prototype attribute modification by implementing proper validation of JavaScript object property assignments.

Workarounds

• Disable JavaScript execution in Adobe Acrobat Reader via Edit → Preferences → JavaScript → Uncheck "Enable Acrobat JavaScript"
• Enable Protected View for all files via Edit → Preferences → Security (Enhanced) → Enable Protected View for all files
• Implement application allowlisting to restrict execution of unexpected processes spawned by Acrobat
• Use alternative PDF readers that do not support JavaScript for viewing untrusted documents

# Windows Registry: Disable JavaScript in Adobe Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enable Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v bEnableProtectedModeAppContainer /t REG_DWORD /d 1 /f