CVE-2026-34626 is a prototype pollution vulnerability (CWE-1321) affecting Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier. The vulnerability allows an attacker to improperly modify object prototype attributes, which can result in arbitrary file system read operations executed in the context of the current user. Exploitation requires that the victim open a maliciously crafted file. The CVSS 3.1 base score is 6.3, reflecting local attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact. No official patch or vendor remediation level has been published yet.

Successful exploitation can lead to unauthorized reading of files accessible by the current user on the system running Adobe Acrobat Reader. This compromises confidentiality but does not affect integrity or availability. The attack requires user interaction (opening a malicious file), limiting the attack vector to social engineering or targeted delivery. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources. No vendor-provided temporary fixes or workarounds are currently documented.