Medium · 6.3 CVE-2026-34626 EUVD-2026-22337GHSA-m5xm-mx43-q65f

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

Published Apr 14, 2026 · Updated Aug 27, 2026 · Assigned by adobe

Vendor: Adobe Product: Acrobat 2024 Product: Acrobat DC Product: Acrobat Reader DC

Description

Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary file system read in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products

Vendor	Product	Affected	Fixed
Adobe	Acrobat DC	≤ 26.001.21411	26.001.21431
Adobe	Acrobat Reader DC	≤ 26.001.21411	26.001.21431
Adobe	Acrobat 2024	≤ 24.001.30362 (Win), 24.001.30360 (Mac)	24.001.30365

Advisories 1

WID-SEC-2026-1107 Adobe Acrobat DC, Acrobat Reader DC und Acrobat Reader: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 14, 2026

References

https://helpx.adobe.com/security/products/acrobat/apsb26-44.html vendor-advisory