A critical security flaw in Adobe Acrobat Reader has been exploited by hackers for over four months, putting countless users at risk. The vulnerability, discovered by security researcher Haifei Li, is described as a “highly sophisticated, fingerprinting-style” attack that requires no user interaction beyond simply opening a malicious PDF.
The exploit operates silently, gathering sensitive local information from compromised systems. This isn’t just about stolen passwords; the potential extends to a complete system takeover, allowing attackers to execute arbitrary code and gain full control of a victim’s machine.
What makes this threat particularly alarming is its stealth. The exploit works on the latest versions of Adobe Reader, bypassing typical security measures. It’s a zero-day vulnerability, meaning Adobe was unaware of its existence until recently, leaving users exposed.
The danger is immediate and simple: opening a compromised PDF file is enough to initiate the attack. This makes phishing campaigns and malicious attachments especially dangerous vectors for spreading the exploit.
Adobe has now released an emergency fix to address this serious vulnerability. Users should immediately update Acrobat Reader to version 26.001.21411. Those using the 2024 version should update to 24.001.30362 for Windows and 24.001.30360 for Mac.
If updating is delayed for any reason, extreme caution is advised. Avoid opening PDF files from unknown or untrusted sources. This is sound security practice in general, but it’s now absolutely crucial to protect against this exploit.
