CVE-2026-81994

Received Received - Intake

Improper Prototype Pollution in Acrobat Reader

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Adobe Systems Incorporated

Description

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-81994

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	acrobat_reader	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This is a Prototype Pollution vulnerability in Acrobat Reader that allows an attacker to modify object prototype attributes. This can lead to arbitrary file system read, enabling access to sensitive files outside the intended scope. Exploitation requires user interaction, such as opening a malicious file.

Detection Guidance

Detection of this vulnerability primarily involves monitoring for suspicious file activity or unauthorized access attempts. Since exploitation requires user interaction to open a malicious file, check for recently opened PDF files from untrusted sources. Review system logs for unusual file read operations outside expected directories.

Impact Analysis

If exploited, this vulnerability could allow attackers to read sensitive files on your system. Since it requires user interaction, you would need to open a malicious file for the attack to succeed. The impact includes potential data theft or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Update Adobe Acrobat Reader to the latest version immediately. Disable JavaScript in Acrobat Reader settings to reduce attack surface. Avoid opening PDF files from untrusted sources. Implement application allowlisting to restrict PDF reader execution paths.

Hi! I’m here to help you understand CVE-2026-81994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70