CVE catalog

CVE-2026-34626

Acrobat Reader versions 26.001.21411, 24.001.30360…

[CVE catalog]

Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary file system read in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity
Medium · CVSS 6.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedacrobat24.001.30365UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedacrobat_dc26.001.21431UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedacrobat_reader_dc26.001.21431UnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedacrobat24.001.30365UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedacrobat_dc26.001.21431UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedacrobat_reader_dc26.001.21431UnknownSource applicability is not establishedProvider not reported
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "acrobat",
      "fixed_version": "24.001.30365",
      "applicability_unknown": true
    },
    {
      "name": "acrobat_dc",
      "fixed_version": "26.001.21431",
      "applicability_unknown": true
    },
    {
      "name": "acrobat_reader_dc",
      "fixed_version": "26.001.21431",
      "applicability_unknown": true
    },
    {
      "name": "acrobat",
      "ranges": [
        {
          "fixed": "24.001.30365",
          "introduced": "24.0.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34626",
      "fixed_version": "24.001.30365",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-34626",
      "provider_updated_at": "2026-10-26T21:10:00.170"
    },
    {
      "name": "acrobat_dc",
      "ranges": [
        {
          "fixed": "26.001.21431",
          "introduced": "15.008.20082",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34626",
      "fixed_version": "26.001.21431",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-34626",
      "provider_updated_at": "2026-10-26T21:10:00.170"
    },
    {
      "name": "acrobat_reader_dc",
      "ranges": [
        {
          "fixed": "26.001.21431",
          "introduced": "15.008.20082",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34626",
      "fixed_version": "26.001.21431",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-34626",
      "provider_updated_at": "2026-10-26T21:10:00.170"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]