Full Report
Threat actors have been exploiting a previously unknown zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December 2025. The finding, detailed by EXPMON's Haifei Li, has been described as a highly-sophisticated PDF exploit. The artifact ("Invoice540.pdf") first appeared on the VirusTotal platform on November 28, 2025. A second
Analysis Summary
# Vulnerability: Adobe Reader JavaScript API Execution Zero-Day
## CVE Details
- **CVE ID:** Not yet assigned (Zero-day as of April 2026)
- **CVSS Score:** N/A (Estimated Critical/High)
- **CWE:** CWE-693: Protection Mechanism Failure / CWE-267: Privilege Chaining
## Affected Systems
- **Products:** Adobe Acrobat Reader
- **Versions:** Confirmed to affect the "latest version" (as of April 2026)
- **Configurations:** Systems where JavaScript is enabled in Adobe Reader and users open untrusted PDF documents.
## Vulnerability Description
The vulnerability allows for the unauthorized execution of privileged Acrobat APIs via maliciously crafted PDF documents containing obfuscated JavaScript. The flaw bypasses standard security restrictions, enabling the document to automatically trigger data collection and exfiltrate information to a remote server. Security researchers indicate that this initial access can facilitate sandbox escape (SBX) and remote code execution (RCE) by downloading follow-up payloads.
## Exploitation
- **Status:** Exploited in the wild (since at least December 2025)
- **Complexity:** High (described as "highly sophisticated")
- **Attack Vector:** Local (requires a user to open a malicious file, typically distributed via phishing/social engineering)
## Impact
- **Confidentiality:** High (leakage of local information and device fingerprinting)
- **Integrity:** High (potential for follow-on RCE payloads)
- **Availability:** Medium to High (dependent on the nature of the secondary payload)
## Remediation
### Patches
- **None:** As of the reporting date (April 9, 2026), this is an unpatched zero-day vulnerability.
### Workarounds
- **Disable JavaScript:** In Adobe Reader, navigate to `Edit > Preferences > JavaScript` and uncheck "Enable Acrobat JavaScript."
- **Protected View:** Ensure "Protected View" is enabled for all files under `Security (Enhanced)` preferences.
- **Email Filtering:** Block incoming PDF attachments from untrusted or external sources, particularly those utilizing social engineering lures.
## Detection
### Indicators of Compromise (IoCs)
- **Files:**
- `Invoice540.pdf` (MD5/SHA-256 samples found on VirusTotal as of Nov 2025 and March 2026)
- **Network:**
- Exfiltration IP: `169.40.2[.]68:45191`
- **Lure Content:** Russian language documents referencing oil and gas industry events.
### Detection Methods and Tools
- Monitor for Adobe Reader (`AcroRd32.exe` or `Acrobat.exe`) making unusual outbound network connections to unauthorized IP addresses.
- Use EDR/AV tools to scan for obfuscated JavaScript within PDF streams.
- Monitor for the creation of unexpected child processes from Adobe Reader.
## References
- EXPMON Haifei Li: hxxps[://]justhaifei1[.]blogspot[.]com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader[.]html
- VirusTotal Artifact 1: hxxps[://]www[.]virustotal[.]com/gui/file/54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f
- VirusTotal Artifact 2: hxxps[://]www[.]virustotal[.]com/gui/file/65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7
- Security Researcher Gi7w0rm: hxxps[://]x[.]com/Gi7w0rm/status/2042003381158379554