Don't forget to update Acrobat. 🚨

Adobe released an urgent security update to fix the Zero-Day vulnerability in Acrobat and Acrobat Reader that has been used to attack it since last December. This weakness is highly dangerous. Because users can open a PDF file immediately without doing anything to add Zero Click.

.

The vulnerability is tracked as CVE-2026-34621. The severity follows CVSSv3 8.6 / 10 points. It is caused by the fact that some PDF files that have been embedded by the virus can be dropped from the program's sandbox system and run a highly eligible JavaScript API. This results in the attacker being able to access local files, read critical data, or run additional malicious code.

.

According to the analysis, the vulnerability uses functions like util.readFileIntoStream () to read local files, and uses RSS.addFeed () to send data out to the hacker's server, as well as to extract additional code into the maran in the victim's system.

.

This vulnerability was discovered by Haifei Li, founder of the EXPMON detection system. The latter had sample file senders come in to analyze it. In the early days malware evaded the protection system very well. Only 5 of the 64 systems detected it, making the attack easy to spread.

.

Adobe states that this vulnerability affects both Windows and macOS. It covers several versions of Acrobat and Reader that have not been updated. It recommends that users update the software immediately via the Help > Check for Updates menu or download it from the official website, as there is no way to protect it other than to install patches.

.

- Acrobat DC and Acrobat Reader DC version 26.001.21367 and earlier, update to version 26.001.21411 or later

- Acrobat 2024 version 24.001.30356 and earlier, update to version 24.001.30362 for Windows and 24.001.30360 for macOS or later versions

.

Users should avoid opening PDF files from unreliable sources and should use them in a secure environment to reduce the risk of this type of attack.

.

Source: neowin

# IT should know # IT News # Includes IT matters # IT