ercihan/cve-2026-34621Technical analysis of Adobe Acrobat JavaScript trust boundary flaw, documenting native handler mappings and privilege-gating logic for CVE-2026-34621.
Reverse-engineering notes and supporting material for an analysis of the Adobe Acrobat JavaScript trust model and its relation to the reported zero-day abuse path involving privileged Acrobat APIs.
This repository contains a technical analysis of how Adobe Acrobat exposes privileged JavaScript functionality through native handlers, how those handlers are gated, and why the observed issue is best understood as a trust/context handling flaw rather than a simple missing access check.
The analysis focuses on the recovered execution path for:
util.readFileIntoStreamapp.trustedFunctionapp.beginPrivThe core conclusion is that the vulnerable behavior is most consistent with untrusted document JavaScript being treated as if it were executing in a privileged context.
The reverse engineering shows the following:
util.readFileIntoStream is exported through the Acrobat JavaScript layer to a native handlerBatch, Exec, and Consoleapp.trustedFunction is also gated and constructs trusted wrappers only under allowed conditionsapp.beginPriv is separately protected by a gate predicate before privileged mode is enteredThis structure suggests that exploitation does not rely on the privileged APIs being totally unprotected, it more likely relies on incorrect trust propagation, context confusion, or misclassification of the current execution frame.
This repository is intended to document:
The paper includes:
util.readFileIntoStreamapp.trustedFunctionapp.beginPrivKey recovered mappings include:
util.readFileIntoStream -> sub_7F9EFapp.trustedFunction -> sub_77AF5app.beginPriv -> sub_7801Fapp.endPriv -> sub_780BBapp.isTrusted -> sub_78BF3The paper also discusses:
cDIPath and bEncodeBase64Batch, Exec, Console, App, Init, Internal, External