# CVE-2026-34621: Adobe Acrobat and Reader Zero-Day Arbitrary Code Execution via Crafted PDF (Emergency Out-of-Band Patch)

> Adobe released an emergency out-of-band security update for Adobe Acrobat and Acrobat Reader on Windows and macOS to address CVE-2026-34621, a critical use-after-free vulnerability in the PDF rendering engine that allows arbitrary code execution in the context of the current user when a victim opens a specially crafted PDF. The flaw is under active exploitation in targeted phishing campaigns delivering weaponized PDFs to enterprise mail users, and proof-of-concept code has surfaced in underground forums within hours of the advisory.

- **Published:** 2026-04-13T12:00:00Z
- **Last reviewed:** 2026-04-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0354
- **ID:** TL-2026-0354
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ZERO_DAY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-34621

## Description

CVE-2026-34621 is a critical client-side remote code execution vulnerability disclosed and patched out-of-band by Adobe on 2026-04-13. The flaw is rooted in a use-after-free condition in the JavaScript-to-AcroForm bridge of the PDF rendering engine shared by Adobe Acrobat and Adobe Acrobat Reader. When an attacker-supplied PDF triggers a crafted sequence of form field mutations while a referenced object is being garbage collected, the engine dereferences a stale pointer that the attacker controls via heap grooming, yielding full arbitrary code execution in the context of the process that opened the document.

Exploitation requires only that the victim open the malicious PDF; no further user interaction, sandbox escape gadget, or administrative privileges are needed to reach initial code execution. The attacker-delivered shellcode runs inside the Acrobat renderer process and, in the observed in-the-wild campaigns, immediately pivots out of the Reader Protected Mode sandbox using a second-stage broker abuse chain that exploits a previously-hardened but still exposed inter-process communication (IPC) endpoint. Post-exploitation, the attacker drops a loader to %APPDATA%\Adobe\Reader\ that establishes persistence via a Scheduled Task named "AdobeAcroUpdater" and beacons to HTTPS C2 infrastructure over 443.

Targeted phishing campaigns first observed by enterprise mail security vendors between 2026-04-02 and 2026-04-09 delivered the weaponized PDFs as attachments to invoices, contract negotiations, and HR onboarding lures, predominantly against finance, legal, and defense industrial base targets in North America and Europe. Adobe's Product Security Incident Response Team (PSIRT) was notified on 2026-04-05 by a combination of industry partners and an independent researcher; Adobe confirmed exploitation, accelerated a fix, and shipped APSB26-18 on 2026-04-13 as an out-of-band release, breaking the normal monthly cadence.

Adobe Acrobat DC, Acrobat 2020, Acrobat Reader DC, and Acrobat Reader 2020 are all affected on Windows and macOS. Linux is not affected because the vulnerable code path is not compiled into the Linux preview. CISA is expected to add CVE-2026-34621 to the Known Exploited Vulnerabilities (KEV) catalog within 24-48 hours of disclosure, which will make remediation mandatory for US Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive 22-01. Defenders should prioritize immediate patching, enablement of Protected View for all network and email-sourced PDFs, blocking of the known IOCs at the perimeter, and hunting for the persistence and C2 indicators listed in this report.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1204 User Execution
- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1059.007 JavaScript
- T1203 Exploitation for Client Execution
- T1053 Scheduled Task/Job
- T1053.005 Scheduled Task
- T1547 Boot or Logon Autostart Execution
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1573.002 Asymmetric Cryptography
- T1082 System Information Discovery
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel

## Sources

- [SOCRadar: CVE-2026-34621 Adobe Acrobat Reader Zero-Day Enables Arbitrary Code Execution via Crafted PDF](https://socradar.io/blog/cve-2026-34621-adobe-acrobat-reader-0-day-pdf/)
- [Adobe Security Bulletin APSB26-18: Security update available for Adobe Acrobat and Reader](https://helpx.adobe.com/security/products/acrobat/apsb26-18.html)
- [NVD - CVE-2026-34621](https://nvd.nist.gov/vuln/detail/CVE-2026-34621)
- [CISA Advisory on Active Exploitation of Adobe Acrobat and Reader](https://www.cisa.gov/news-events/alerts/2026/04/13/adobe-releases-emergency-security-update)
- [MITRE CWE-416: Use After Free](https://cwe.mitre.org/data/definitions/416.html)
- [Adobe PSIRT Acknowledgments Page](https://helpx.adobe.com/security/psirt-credits.html)
- [BleepingComputer: Adobe emergency update patches exploited Acrobat Reader zero-day](https://www.bleepingcomputer.com/news/security/adobe-emergency-update-patches-exploited-acrobat-reader-zero-day/)
- [MITRE ATT&CK - T1204.002 User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0354