A newly discovered Adobe Reader vulnerability is being actively exploited through malicious PDF files, putting users at risk of data theft and further attacks.
Quick Summary – TLDR:
- Zero day vulnerability in Adobe Reader exploited since late 2025.
- Malicious PDFs use social engineering to trick users into opening files.
- Attack enables data harvesting and potential remote code execution.
- No official patch yet, security experts urge caution.
What Happened?
Security researchers have identified an actively exploited zero day vulnerability in Adobe Reader that is being delivered through specially crafted PDF documents. The flaw has reportedly been in use since at least November 2025 and continues to pose a risk to users worldwide.
⚠️ Attackers are exploiting a 0-day in Adobe Reader via malicious PDFs.
— The Hacker News (@TheHackersNews) April 9, 2026
Opening the file runs hidden JavaScript to steal data and stage further exploits, including possible RCE. It works on the latest version & has been active since Dec 2025.
🔗 Read → https://t.co/GlpjmXrHCe
Malicious PDFs Used as Entry Point
The attack begins with a seemingly harmless PDF file, often disguised with names like invoices or other relevant documents. These files are designed to lure users into opening them, relying heavily on social engineering tactics.
Once opened, the PDF automatically executes heavily obfuscated JavaScript code embedded within the file. This code initiates the attack without requiring further user interaction, making it particularly dangerous.
Researchers observed that some of these PDFs include Russian language content related to oil and gas industry events, suggesting targeted campaigns aimed at specific sectors or regions.
Data Harvesting and Fingerprinting Capabilities
The embedded script is capable of collecting a wide range of system information, including:
- Operating system details
- Adobe Reader version
- Language settings
- File path information
This data is then sent to attacker controlled servers, enabling advanced fingerprinting of the victim system. Based on this information, attackers can decide whether to proceed with further stages of the attack.
Experts believe this selective approach helps attackers avoid detection and improve success rates, as payloads may only be delivered to high value or suitable targets.
Potential for Remote Code Execution
Beyond data collection, the exploit shows signs of being capable of enabling:
- Remote code execution
- Sandbox escape techniques
- Delivery of additional malicious payloads
However, researchers were unable to fully observe the second stage payload delivery. This could be due to server side conditions not being met during testing, indicating a highly controlled and sophisticated attack chain.
Even without full payload execution, the ability to abuse unpatched functionality in Adobe Reader is enough to raise serious concerns in the cybersecurity community.
Detection and Timeline of the Attack
Evidence suggests the exploit has been active for several months:
- First known sample uploaded in November 2025.
- Additional samples surfaced in March 2026.
- Detected through advanced sandbox analysis systems.
Security researchers, including Haifei Li, have confirmed that the exploit works on the latest version of Adobe Reader, reinforcing its classification as a true zero day vulnerability.
No Patch Yet, Users Urged to Stay Alert
Despite responsible disclosure, no official fix has been released yet. This leaves users exposed to ongoing threats.
Security experts recommend immediate precautions:
- Avoid opening PDF files from unknown or untrusted sources.
- Monitor systems for unusual activity linked to Adobe processes.
- Block known malicious IP addresses and suspicious network traffic.
- Watch for abnormal behavior such as unexpected external connections.
Organizations are also advised to monitor for suspicious API calls and unusual execution patterns within PDF handling processes.
SQ Magazine’s Takeaway
I think this is one of those threats that quietly spreads while most users remain unaware. A simple PDF file is something we all trust and open daily, which makes this attack especially dangerous. The fact that it works on the latest version with no fix yet is worrying. If I were handling sensitive data, I would treat every unexpected PDF as a potential threat right now.
