This Adobe Reader zero-day vulnerability enables threat actors to leverage malicious PDF files that execute obfuscated JavaScript to invoke privileged Acrobat APIs. The exploitation can result in unauthorized access to sensitive data and potentially remote code execution. The vulnerability has been exploited in the wild since at least December 2025. No affected versions or official patches are specified. Indicators such as file hashes, IP addresses, and a suspicious domain are associated with the campaign. The vendor has not publicly released a patch or advisory as of the provided data.

Successful exploitation allows attackers to steal sensitive user and system information and potentially execute code remotely, which could lead to further attacks on the affected system. The vulnerability poses a medium severity risk given the potential for data theft and remote code execution, but no confirmed widespread exploitation or known threat actors are detailed.

No official patch or fix is currently confirmed. Recommended mitigations include automatically scanning PDF email attachments and blocking suspicious files, training users to be cautious with unsolicited attachments, and advising users to temporarily avoid using Adobe Reader to open PDF files until a vendor fix is available. Organizations should monitor vendor advisories for updates on remediation.