Medium severity · published Sep 8, 2026
CVE-2026-81994
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
6.3
CVSS
0.6%
EPSS
No
On KEV
Description
Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
Acrobat 2024 · Adobe
through 24.001.30383 · source: vendor
AR
Acrobat Reader · Adobe
through 26.002.21900 · source: vendor
AA
Adobe Acrobat · Adobe
through 26.002.21900 · source: vendor
AC
Acrobat · Adobe
24.001.20604 before 24.001.30429 · source: NVD
AD
Acrobat DC · Adobe
15.008.20082 before 26.002.21901 · source: NVD
AR
Acrobat Reader DC · Adobe
15.008.20082 before 26.002.21901 · source: NVD
Affected product
A2
Acrobat 2024
Adobe
More from Acrobat 2024
8.6
CVE-2026-34621
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
8.8
CVE-2026-81996
Acrobat Reader | Incorrect Authorization (CWE-863)
8.6
CVE-2026-34622
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
7.8
CVE-2026-81989
Acrobat Reader | Use After Free (CWE-416)
7.8
CVE-2026-81980
Acrobat Reader | Out-of-bounds Write (CWE-787)