Adobe Reader Zero-Day Exploited for Data Theft

Security researchers have uncovered a zero-day vulnerability in Adobe Reader that hackers have exploited for at least five months, using malicious PDF files to steal sensitive data from victims' computers. The flaw, first detected in late November 2025, allows attackers to gather system information without any user interaction beyond opening the document, potentially paving the way for more severe cyberattacks.

Haifei Li, founder of the exploit detection system EXPMON, identified the vulnerability after a suspicious PDF sample was submitted to his platform on March 26, 2026. Analysis revealed that the file, named variations like "Invoice540.pdf" or "yummy_adobe_exploit_uwu.pdf," contains heavily obfuscated JavaScript code that activates automatically upon opening in the latest version of Adobe Reader. The code abuses built-in APIs, including util.readFileIntoStream to read local files and RSS.addFeed to transmit the harvested data to remote servers, such as one at IP address 169.40.2.68.

"This zeroday-unpatched vulnerability works on the latest version of Adobe Reader without requiring any user interaction beyond opening a PDF file," Li stated in his report. The exploit collects...