Adobe Acrobat Reader contains a prototype pollution flaw that allows an attacker to modify object prototype attributes during the processing of a PDF file. This weakness, identified as CWE‑1321, can result in arbitrary code execution in the context of the current user. The vulnerability arises from an improper control over how JavaScript objects are altered when a crafted file is opened.

Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and all earlier releases are affected. All editions of Acrobat Reader that ship with these version numbers on any supported operating system are vulnerable.

The CVSS score of 8.6 categorizes this flaw as high severity, indicating substantial risk to confidentiality, integrity, and availability. Exploitation requires the victim to open a malicious PDF file, so the attack vector depends on the user’s interaction with the document. The severity rating and user‑interaction requirement highlight the need for proactive remediation.