Alarm raised over Adobe PDF zero-day vulnerability

Adobe Acrobat PDF folderIf you are one of the world’s many users of Adobe’s Acrobat PDF Reader software then there’s good reason to prick up your ears and listen today, as details emerge of a critical zero-day vulnerability in the software that could allow hackers to run malicious code on computers.

According to a warning from the security response team at Adobe, a serious vulnerability in all currently supported versions of Adobe Reader and Acrobat ((Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions) are affected by the flaw.

The vulnerability, which is not limited to Windows users but also affects Mac and Unix users, means that Adobe users are being advised to disable JavaScript in Adobe Reader and Acrobat until a proper fix is available.

Adobe advises that JavaScript can be disabled by following these instructions:

Sign up to our free newsletter.
Security news, advice, and tips.

1. Launch Acrobat or Adobe Reader.
2. Select Edit/Preferences
3. Select the JavaScript Category
4. Uncheck the “˜Enable Acrobat JavaScript’ option
5. Click OK

Of course, this is far from the first time that critical vulnerabilities have been found in Adobe’s software, and there is growing concern that the vendor’s dominant market share of the PDF reader market is proving extremely attractive for hackers hellbent on infecting as many PCs as possible.

As we predicted in the Sophos 2009 Security Threat Report, hackers are increasingly looking at commonly used browser plugins like Adobe Flash and PDF in their attempts to infect innocent computer users.

In the past I’ve suggested that computer users may want to use FoxIt, an alternative to Adobe PDF Reader. However, on reflection, I think that advice wasn’t that great because if everyone switched en masse to the same alternative to Adobe Reader we’d all be in the same pickle again.

A world of everyone using the same software as everyone else is never healthy for security.

Instead, make your own choice of which PDF reader to use. You can find a helpful list of some suggestions at

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.