Adobe Acrobat Reader Prototype Pollution — بهره‌برداری فعال

CVE-2026-34621 is a high/critical severity Prototype Pollution vulnerability (CWE-1321) in Adobe Acrobat and Acrobat Reader, actively listed in the CISA Known Exploited Vulnerabilities catalog.

## Vulnerability Overview
An improperly controlled modification of object prototype attributes in Adobe Acrobat and Reader allows an attacker to execute arbitrary code in the context of the current user. Exploitation requires the victim to open a specially crafted malicious PDF file.

## Technical Details
- **Type:** Prototype Pollution (CWE-1321)
- **Vulnerable Component:** Adobe Acrobat / Acrobat Reader PDF rendering engine
- **Root Cause:** Input from an upstream component specifies attributes to be initialized or updated in an object, but the product does not properly control modifications of attributes of the object prototype.
- **Trigger:** Opening a malicious PDF file crafted to pollute JavaScript object prototypes within the Acrobat scripting engine.
- **Impact:** Arbitrary code execution in the context of the current user.

## CISA KEV Entry
- Added to CISA Known Exploited Vulnerabilities catalog on **2026-04-13**.
- Required action deadline: **2026-04-27**.
- Required action: Apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.

## CVSS Scores
- **9.6 CRITICAL** — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (initial, 2026-04-11)
- **8.6 HIGH** — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (revised, 2026-04-12)

## Affected Versions
- Adobe Acrobat DC (Continuous) versions before 26.001.21411
- Adobe Acrobat Reader DC (Continuous) versions before 26.001.21411
- Adobe Acrobat Classic 24.x before 24.001.30362 (Windows)
- Adobe Acrobat Classic 24.x before 24.001.30360 (macOS)
- **Requires:** User interaction — victim must open a malicious file