CVE-2026-81994: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) in Adobe Adobe Acrobat

CVE-2026-81994 is a prototype pollution vulnerability in Adobe Acrobat that permits improper modification of object prototype attributes. Exploitation requires user interaction, specifically opening a crafted malicious file, and can result in arbitrary reading of files and directories beyond the intended access boundaries. The vulnerability affects Adobe Acrobat versions up to 26.002.21900 and 24.001.30383. The CVSS v3.1 score is 8.2, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction needed, changed scope, and high confidentiality and integrity impacts.

Successful exploitation allows an attacker to read arbitrary files on the victim's system, potentially exposing sensitive information. The attack requires the victim to open a malicious file, and the vulnerability changes the security scope, increasing the potential impact on confidentiality and integrity. There is no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should avoid opening untrusted files and follow Adobe's security recommendations.