Adobe fixes PDF zero-day security bug that hackers have exploited for months

Adobe patched a critical zero-day vulnerability (CVE-2026-34621) in Acrobat DC, Reader DC, and Acrobat 2024 that allowed remote code execution via malicious PDFs. The vulnerability had been actively exploited for at least four months, with malicious samples first appearing in late November 2025. Security researcher Haifei Li discovered the exploit through his EXPMON malware detection system.