{"id":"CVE-2026-34621","published":"2026-04-11T07:16:03Z","modified":"2026-10-26T21:10:00Z","title":"Adobe Acrobat and Reader Prototype Pollution Vulnerability","vendor":"Adobe","product":"Acrobat and Reader","tier":"core","eol":null,"description":{"text":"Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","provenance":"source","from":"NVD"},"summary":{"text":"A prototype pollution flaw in Adobe Acrobat and Reader, which is caused by improperly controlled modification of object prototype attributes, lets malicious input alter object prototypes. An attacker who can get a victim to open a malicious file can achieve arbitrary code execution in the context of the current user, with no prior authentication required but user interaction necessary.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:41Z"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0723,"percentile":0.94326,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2026-04-13","dueDate":"2026-04-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-04-07","exploitedFirstSeen":"2026-04-07","ransomware":false,"evidence":[{"url":"https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html","date":"2026-04-07"},{"url":"https://helpx.adobe.com/security/products/acrobat/apsb26-43.html","date":"2026-04-11"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2026-04-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-04-13"},{"url":"https://nefariousplan.com/posts/adobe-acrobat-cve-2026-34621-detection-lie","date":"2026-04-23"},{"url":"https://ti.qianxin.com/uploads/2026/10/29/20ab59a356a884498644cff73d47a13a.pdf","date":"2026-10-29"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://helpx.adobe.com/security/products/acrobat/apsb26-43.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: User opens malicious file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"a victim must open a malicious file","start":329,"end":364}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Code execution in reader process","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could result in arbitrary code execution in the context of the current user","start":191,"end":266}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-21675","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21675","exploited":true,"exploitedSince":"2026-04-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2026-04-13","earliestUrl":"https://github.com/ercihan/CVE-2026-34621","repos":[{"name":"azefzafyoussef/CVE-2026-34621","url":"https://github.com/azefzafyoussef/CVE-2026-34621","stars":26,"created":"2026-05-12"},{"name":"NULL200OK/cve_2026_34621_advanced","url":"https://github.com/NULL200OK/cve_2026_34621_advanced","stars":13,"created":"2026-04-15"},{"name":"ercihan/CVE-2026-34621","url":"https://github.com/ercihan/CVE-2026-34621","stars":2,"created":"2026-04-13"},{"name":"ercihan/CVE-2026-34621_PDF_SAMPLE","url":"https://github.com/ercihan/CVE-2026-34621_PDF_SAMPLE","stars":2,"created":"2026-04-17"},{"name":"KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621","url":"https://github.com/KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621","stars":1,"created":"2026-04-14"}]},"first":{"date":"2026-04-13","source":"PoC-in-GitHub","url":"https://github.com/ercihan/CVE-2026-34621"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"}],"timeline":[{"date":"2026-04-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html","provenance":"source"},{"date":"2026-04-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34621","provenance":"source"},{"date":"2026-04-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ercihan/CVE-2026-34621","provenance":"source"},{"date":"2026-04-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21675","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 208 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.87,"detail":"percentile 0.9433"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.02,"detail":"base score 8.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}