Adobe Fixes Critical PDF Zero-Day Security Bug After Four Months of Exploitation

Adobe has patched a vulnerability in its flagship document-reading apps, Acrobat DC, Reader DC, and Acrobat 2024, which hackers have been exploiting for at least four months. The bug allows hackers to remotely plant malware on a person's device by tricking them into opening a malicious PDF file.

Security experts have warned that hackers have been actively exploiting the zero-day vulnerability, which affects Windows devices and macOS computers.

The vulnerability, officially tracked as CVE-2026-34621, was discovered by security researcher Haifei Li, who runs the exploit-detection system EXPMON. Li said that the bug allows hackers to steal a wide range of data from a victim's system, including potentially sensitive information.

According to Li's analysis, opening a malicious PDF and triggering the exploit "could lead to full control of the victim's system."

Adobe has urged users to update their software to the latest versions to prevent exploitation of the vulnerability. The company has also acknowledged that the bug is being exploited in the wild, which means hackers have been using it to break into people's computers before Adobe could fix it.

• The affected software versions include Acrobat DC, Reader DC, and Acrobat 2024.
• Users are advised to update their software to the latest versions to prevent exploitation of the vulnerability.
• Adobe has acknowledged that the bug is being exploited in the wild, which means hackers have been using it to break into people's computers before Adobe could fix it.

While it's not clear who is behind the hacking campaign, the ubiquity of Adobe's PDF-reading software makes it a consistent target for cyber criminals and government-backed hackers, who have long abused weaknesses in the software to steal data from people's computers.

The discovery of the vulnerability highlights the ongoing risks associated with using PDF files, which can be easily exploited by hackers to plant malware on a person's device. As a result, Adobe's patch is a critical update for users, and it's essential to ensure that all software is up-to-date to prevent exploitation of the vulnerability.