Adobe Acrobat Zero‑Day CVE‑2026‑34621 Arbitrary Code Execution

Affected Environment
Adobe Acrobat DC, Acrobat Reader DC, and Acrobat 2024 are affected in versions at or below the listed builds. Any users with these versions may be exposed.

Threat Overview
Zero-day CVE‑2026‑34621 allows arbitrary code execution via malicious PDFs in Adobe Acrobat and Reader. Exploitation is already observed in the wild.

Exposure Timeline
Adobe has disclosed the vulnerability and released a security update as of 13 April 2026. Exposure persists until affected versions are updated.

Attack Surface
Endpoints with vulnerable Acrobat or Reader that can open external PDF files form the main exposure. User interaction is required to open a malicious file.

Technical Root Cause
The issue is a prototype pollution flaw in Acrobat/Reader that allows modification of object prototype attributes. This can lead to arbitrary code execution.

Exploitation PathwayAttackers deliver crafted PDFs, such as invoice lures, to victims. When opened in a vulnerable client, code runs in the context of the current user.