CVE-2026-34622: Adobe Acrobat RCE Vulnerability

CVE-2026-34622 Overview

CVE-2026-34622 is a critical Prototype Pollution vulnerability affecting Adobe Acrobat Reader that could result in arbitrary code execution in the context of the current user. The vulnerability exists in Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier across both Windows and macOS platforms. Successful exploitation requires user interaction where a victim must open a specially crafted malicious PDF file.

Critical Impact

This vulnerability allows attackers to execute arbitrary code with the privileges of the current user by leveraging a Prototype Pollution flaw in Adobe Acrobat Reader's JavaScript engine. A successful attack could lead to complete system compromise.

Affected Products

• Adobe Acrobat (Classic track) - versions prior to security update
• Adobe Acrobat DC (Continuous track) - versions prior to security update
• Adobe Acrobat Reader DC (Continuous track) - versions prior to security update

Discovery Timeline

• 2026-04-14 - CVE-2026-34622 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-34622

Vulnerability Analysis

CVE-2026-34622 is classified as CWE-1321: Improperly Controlled Modification of Object Prototype Attributes, commonly known as Prototype Pollution. This vulnerability class affects JavaScript engines and allows attackers to modify the prototype of base objects, potentially leading to arbitrary code execution.

In the context of Adobe Acrobat Reader, the JavaScript engine embedded within the application fails to properly sanitize or validate object property assignments. When processing maliciously crafted PDF documents containing JavaScript, an attacker can pollute the prototype chain of built-in JavaScript objects. This pollution can then be leveraged to hijack application control flow and execute arbitrary code.

The attack is local in nature, requiring the victim to open a malicious PDF file. However, the scope extends beyond the vulnerable component, potentially affecting the confidentiality, integrity, and availability of the underlying operating system.

Root Cause

The root cause of this vulnerability lies in improper validation of user-controlled input when modifying JavaScript object properties within Adobe Acrobat Reader's JavaScript interpreter. The application fails to prevent modification of the __proto__ property or similar prototype chain manipulation techniques, allowing attackers to inject malicious properties into base object prototypes that are later accessed during normal application execution.

Attack Vector

The attack vector for CVE-2026-34622 is local and requires user interaction. An attacker must craft a malicious PDF document containing specially designed JavaScript code that exploits the Prototype Pollution vulnerability. The attack chain typically follows this pattern:

1. Attacker creates a PDF document with embedded JavaScript that manipulates object prototypes
2. The malicious JavaScript pollutes the prototype of built-in objects with attacker-controlled properties
3. Victim opens the malicious PDF in Adobe Acrobat Reader
4. The polluted prototype properties are accessed during subsequent JavaScript execution
5. The attacker-controlled code executes in the context of the current user

The vulnerability requires no special privileges to exploit, making it accessible to any attacker who can deliver a malicious PDF to a target through email, web downloads, or other file delivery mechanisms.

Detection Methods for CVE-2026-34622

Indicators of Compromise

• Unusual JavaScript execution patterns in PDF documents accessing __proto__ or constructor.prototype properties
• PDF files containing obfuscated JavaScript attempting to modify Object.prototype
• Unexpected child processes spawned from Adobe Acrobat Reader processes
• Anomalous memory access patterns in Acrobat Reader suggesting code injection

Detection Strategies

• Deploy endpoint detection rules to monitor Adobe Acrobat Reader for suspicious JavaScript execution patterns
• Implement file inspection capabilities to scan PDF documents for malicious JavaScript payloads before user access
• Enable application-level logging for Adobe products to capture JavaScript execution events
• Utilize behavioral analysis to detect prototype pollution attack patterns in document processing

Monitoring Recommendations

• Monitor for PDF documents attempting to access or modify JavaScript prototype chain objects
• Track process creation events from AcroRd32.exe or Acrobat.exe for unexpected child processes
• Alert on network connections initiated by Adobe Acrobat Reader processes to unknown destinations
• Review endpoint telemetry for signs of post-exploitation activity following PDF document access

How to Mitigate CVE-2026-34622

Immediate Actions Required

• Update Adobe Acrobat Reader to the latest patched version immediately
• Disable JavaScript execution in Adobe Acrobat Reader as a temporary mitigation if patching is not immediately possible
• Implement email gateway filtering to quarantine suspicious PDF attachments
• Educate users about the risks of opening PDF documents from untrusted sources

Patch Information

Adobe has released security updates to address this vulnerability as documented in Adobe Security Advisory APSB26-44. Organizations should apply the appropriate updates for their installed Adobe Acrobat product tracks:

• Continuous Track: Update Adobe Acrobat DC and Acrobat Reader DC to the latest version
• Classic Track: Apply the security update for Adobe Acrobat Classic 2024 and 2020 tracks

Organizations should prioritize patching based on their risk assessment and ensure all affected systems are updated through their standard patch management processes.

Workarounds

• Disable JavaScript in Adobe Acrobat Reader by navigating to Edit > Preferences > JavaScript and unchecking "Enable Acrobat JavaScript"
• Enable Protected View for all files by going to Edit > Preferences > Security (Enhanced) and selecting "Files from potentially unsafe locations" or "All files"
• Implement application whitelisting to prevent unauthorized code execution from Adobe Acrobat Reader
• Consider using alternative PDF readers for opening documents from untrusted sources until patching is complete

# Disable JavaScript in Adobe Acrobat Reader via Registry (Windows)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enable Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f