Adobe Acrobat and Reader Improper Prototype Pollution Vulnerability Allowing Arbitrary File System Read

A prototype pollution vulnerability has been identified in Adobe Acrobat and Acrobat Reader versions through 26.001.21411, as well as in Acrobat 2024 versions through 24.001.30362 on Windows and macOS. This vulnerability could lead to arbitrary file system read in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Impact

Exploitation of this vulnerability could result in unauthorized access to the user's file system, allowing for the reading of arbitrary files.

Remediation

Users are advised to update to the latest versions of Adobe Acrobat or Acrobat Reader. The latest versions can be downloaded from the Adobe website or via the Adobe Update mechanism. For IT administrators, update instructions are available in the release notes for each product.