Adobe has released an important security update to fix a serious problem in its PDF software. The issue was being actively used by hackers for at least four months before it was discovered and patched. It affected widely used Adobe applications, including Acrobat DC, Reader DC, and Acrobat 2024, on both Windows and macOS systems.
Adobe Fixes PDF Zero-Day Vulnerability Exploited for Months
The company confirmed that this was a zero-day vulnerability, which means hackers were already using the flaw before any fix was available. With this update, Adobe has now closed the security gap and improved protection for users. However, users are strongly advised to install the latest update as soon as possible to stay safe from any potential risk.
How the PDF Security Attack Worked
The security issue was very dangerous because it was very easy for hackers to use. A hacker only needed to send a harmful PDF file to a victim, often through email or messaging. If the user opened the file, the attack would start automatically without needing any extra click or action.
Once the file was opened, the exploit could install malware on the device without the user noticing. In serious cases, it could give hackers full control of the system. This means they could access personal files, steal important data, and even track what the user is doing on the device.
How the Adobe Vulnerability Was Discovered
The flaw was discovered after a malicious PDF file was uploaded to online malware scanning platforms. Security researcher Haifei Li found the issue while working with his detection system called EXPMON.
He noticed that the same harmful file had already appeared on VirusTotal in late November 2025. This shows that attackers may have been using the weakness for around four months before Adobe released a fix.
Read more: Adobe Launches ‘Student Spaces’ Free AI Study Tool for Students
At this stage, it is still not clear who was behind the attack or how many users were affected. Experts also said they were unable to collect more samples from the attacker’s system. Because of this, the full size and impact of the campaign are still unknown. However, researchers believe the attack was active and widely used during the time before the patch was released.
Adobe PDF tools are used by millions of people around the world every day. This is why PDF files are often a common target for hackers. Many people open PDF files from emails, websites, or unknown sources without thinking too much about it. Because of this habit, attackers find it easier to trick users and run harmful code through these files.
Cybersecurity experts say PDF-based attacks are especially dangerous because they require very little action from the user.
Adobe Issues Urgent Security Update and Warning
Adobe has now fixed the problem and released security updates for all affected applications. The company confirmed that this security bug was already being used in real attacks before it was discovered and patched. This means hackers were able to take advantage of the flaw while it was still open.
Adobe is strongly advising all users of Acrobat DC, Reader DC, and Acrobat 2024 to update their software to the latest version as soon as possible. Installing these updates is the only way to fully protect devices from this security risk and prevent possible attacks.
This incident shows that even trusted and widely used software can have hidden security problems. Hackers can keep using these security weaknesses for a long time without anyone noticing. That is why users need to stay careful and alert.
Users should always keep their apps updated to the latest version, because updates often fix security problems. It is also important to avoid opening PDF files or links from unknown or untrusted sources, as they can be harmful.
