Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier contain a prototype pollution vulnerability (CWE-1321) that permits attackers to improperly modify object prototype attributes. This vulnerability can lead to arbitrary code execution in the context of the current user after the victim opens a crafted malicious file. The CVSS 3.1 base score is 8.6, reflecting high impact on confidentiality, integrity, and availability with low attack complexity but requiring user interaction. No official patch or remediation level has been published by Adobe as of the data provided.

Successful exploitation can result in arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. Since exploitation requires user interaction (opening a malicious file), the attack vector is limited to scenarios where a user is tricked into opening such a file. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources to avoid triggering this vulnerability.