Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
Summary: Threat actors have been exploiting a previously unknown zero-day in Adobe Reader with maliciously crafted PDFs since at least December 2025, per EXPMON's Haifei Li, who called it a highly-sophisticated PDF exploit. The artifact "Invoice540.pdf" first appeared on VirusTotal on November 28, 2025, a second sample was uploaded on March 23, 2026, and the exploit runs obfuscated JavaScript to harvest data and receive additional payloads, with Adobe releasing updates for CVE-2026-34621 (CVSS 9.6).
Key Takeaway: The exploit is confirmed to work on the latest version of Adobe Reader and abuses a zero-day to execute privileged Acrobat APIs, with observed samples carrying Russian-language lures tied to Russian oil and gas industry current events. Li noted the capability for broad information harvesting plus potential follow-on RCE and sandbox escape is enough for the security community to remain on high alert.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2026-34621
- Related
- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability Known Exploited Vulnerabilities · Apr 13, 2026