← All detection heuristics · CVE
critical
CVE likely
CVE_2026_34621_RELATED
What it means
PDF JavaScript combines Acrobat prototype pollution targeting privileged state with an execution or sensitive file-read primitive.
Why it fires
This finding applies to CVE-2026-34621 PoC and exploit variants that do not carry the exact internal Adobe API markers used by the stricter CVE_2026_34621 rule. It requires a high-signal combination: prototype pollution of privileged state such as __trusted, constructor.prototype.bypass, or __proto__.privileged, plus concrete impact behavior such as app.launchURL(file/cmd/osascript), ActiveXObject('WScript.Shell'), or util.readFileIntoStream(cDIPath). That co-occurrence is not expected in benign PDF forms and keeps the match cheap by using bounded literal and regex checks over raw, decompressed, and bounded base64-decoded JavaScript.
Other CVE heuristics
CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2009_3459 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2010_0188 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118 CVE_2009_0658