Adobe patches zero-day vulnerability in PDF software

Adobe has released a security patch to address a critical vulnerability affecting its flagship document-reading applications, which include Acrobat DC, Reader DC, and Acrobat 2024. The security flaw is officially tracked as CVE-2026-34621, which serves as the official tracking identifier for the vulnerability. The update resolves what is known as a zero-day vulnerability, a term used to describe a vulnerability exploited in the wild before a fix is available. Prior to the release of this patch, hackers had been actively exploiting the security weakness.

The vulnerability allows hackers to remotely plant malware on a person’s device. To execute the attack, threat actors trick users into opening a maliciously crafted PDF file on their Windows device or macOS computer. According to security researcher Haifei Li, who analyzed the exploit, opening a malicious PDF and triggering the vulnerability “could lead to full control of the victim’s system.” This access would grant hackers the ability to steal data from the compromised machine. Adobe acknowledged the active threat in an advisory, noting that hackers have been using it to break into people’s computers before the company could issue a fix.

The security flaw was discovered by Li, who runs the exploit-detection system EXPMON. The vulnerability came to light after a copy of a malicious PDF containing the exploit was uploaded to his malware scanner. Li’s subsequent analysis revealed that another copy of the malware-ridden PDF first appeared on VirusTotal, an online malware scanner, in late November 2025. This timeline indicates that hackers have been actively exploiting for at least four months. Because of the widespread use of Adobe’s document-reading applications, the software remains a frequent target for cybercriminals and government-backed hackers, who have long abused weaknesses in the software to steal data from people’s computers.

Why it matters

Adobe’s PDF software is a ubiquitous tool, making it a high-value target for both cybercriminals and state-sponsored actors looking to compromise Windows and macOS systems.