Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-34621] Three Bugs Walk Into a PDF: Prototype Pollution, Served Cold

starlabs.sg | research | CVE-2026-34621 | #vulnerability-research | #prototype-pollution | #pdf | #patch-analysis | #in-the-wild | #adobe-acrobat | #cve-2026-34621

Summary

In April 2026, Adobe fixed three chained prototype pollution bugs in Acrobat (CVE-2026-34621/34622/34626) letting malicious PDFs execute code and leak data, with in-the-wild exploitation reported.
CVE
CVE-2026-34621
Published
Collected

original ↗

Related coverage

research · starlabs.sg
[CVE-2026-0899] CHECK Removed, Context Confused, Checkmate Achieved
The authors reverse-engineered Chrome's January 2026 fix for CVE-2026-0899, an out-of-bounds access in V8, built a trigger PoC, and defeated a stubborn CHECK to reach arbitrary read/write.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
research · starlabs.sg
When AI Makes 0-Days Feel Like N-Days
The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.
research · starlabs.sg
Old Bug, Harder Rules : Exploiting CVE-2023-36802 Without the Usual Shortcuts
Exploiting CVE-2023-36802, a type confusion in Microsoft's mskssrv.sys driver, without the usual shortcuts: no NtQuery* leaks or PreviousMode read/write, only what works under current mitigations.
research · starlabs.sg
Old Wine in a New Bottle: A Decade-Old lxd-Group Root, Re-Armed
Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.
back