Acrobat Reader versions 24

#!/usr/bin/env python3
# check_cve_2026_34621.py
# Detects vulnerable Adobe Acrobat/Reader versions for CVE-2026-34621.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown/error

import os
import re
import sys
import platform
import subprocess
from pathlib import Path

RESULTS = []

THRESHOLDS = {
    'dc_continuous': ('26.001.21411',),
    'acrobat_2024_windows': ('24.001.30362',),
    'acrobat_2024_macos': ('24.001.30360',),
}


def norm(v):
    nums = [int(x) for x in re.findall(r'\d+', str(v))]
    return tuple(nums)


def cmp_ver(a, b):
    aa = list(norm(a))
    bb = list(norm(b))
    n = max(len(aa), len(bb))
    aa += [0] * (n - len(aa))
    bb += [0] * (n - len(bb))
    return (aa > bb) - (aa < bb)


def add_result(product, version, status, note):
    RESULTS.append({
        'product': product,
        'version': version or 'UNKNOWN',
        'status': status,
        'note': note
    })


def assess_product(name, version, os_name):
    lname = name.lower()
    if not version:
        add_result(name, version, 'UNKNOWN', 'No version found')
        return

    # Continuous DC / Reader DC
    if 'reader' in lname and 'dc' in lname:
        if cmp_ver(version, THRESHOLDS['dc_continuous'][0]) < 0:
            add_result(name, version, 'VULNERABLE', f'Patch level required: >= {THRESHOLDS["dc_continuous"][0]}')
        else:
            add_result(name, version, 'PATCHED', f'Patched threshold: >= {THRESHOLDS["dc_continuous"][0]}')
        return

    if 'acrobat' in lname and 'dc' in lname:
        if cmp_ver(version, THRESHOLDS['dc_continuous'][0]) < 0:
            add_result(name, version, 'VULNERABLE', f'Patch level required: >= {THRESHOLDS["dc_continuous"][0]}')
        else:
            add_result(name, version, 'PATCHED', f'Patched threshold: >= {THRESHOLDS["dc_continuous"][0]}')
        return

    # Acrobat 2024 Classic
    if '2024' in lname and 'acrobat' in lname:
        if os_name == 'Windows':
            target = THRESHOLDS['acrobat_2024_windows'][0]
        else:
            target = THRESHOLDS['acrobat_2024_macos'][0]
        if cmp_ver(version, target) < 0:
            add_result(name, version, 'VULNERABLE', f'Patch level required: >= {target}')
        else:
            add_result(name, version, 'PATCHED', f'Patched threshold: >= {target}')
        return

    # Generic Adobe Reader/Acrobat install found but track unclear
    add_result(name, version, 'UNKNOWN', 'Adobe product found, but track could not be mapped confidently to CVE thresholds')


def scan_windows():
    try:
        import winreg
    except ImportError:
        add_result('Windows registry', None, 'UNKNOWN', 'winreg unavailable')
        return

    uninstall_roots = [
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall'),
        (winreg.HKEY_CURRENT_USER, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'),
    ]

    seen = set()

    def reg_get(key, value):
        try:
            return winreg.QueryValueEx(key, value)[0]
        except OSError:
            return None

    for hive, root in uninstall_roots:
        try:
            with winreg.OpenKey(hive, root) as kroot:
                for i in range(winreg.QueryInfoKey(kroot)[0]):
                    try:
                        subname = winreg.EnumKey(kroot, i)
                        with winreg.OpenKey(kroot, subname) as sk:
                            dn = reg_get(sk, 'DisplayName')
                            dv = reg_get(sk, 'DisplayVersion')
                            if not dn:
                                continue
                            ldn = str(dn).lower()
                            if 'adobe' in ldn and ('acrobat' in ldn or 'reader' in ldn):
                                ident = (dn, dv)
                                if ident in seen:
                                    continue
                                seen.add(ident)
                                assess_product(str(dn), str(dv) if dv else None, 'Windows')
                    except OSError:
                        continue
        except OSError:
            continue

    # Fallback known registry paths
    known_paths = [
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Adobe\Acrobat Reader\DC\Installer', 'Adobe Acrobat Reader DC'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Adobe\Adobe Acrobat\DC\Installer', 'Adobe Acrobat DC'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Adobe\Acrobat Reader\DC\Installer', 'Adobe Acrobat Reader DC'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Adobe\Adobe Acrobat\DC\Installer', 'Adobe Acrobat DC'),
    ]

    for hive, path, name in known_paths:
        try:
            with winreg.OpenKey(hive, path) as k:
                for val in ('ProductVersion', 'Version', 'AcroVersion'):
                    v = reg_get(k, val)
                    if v:
                        ident = (name, v)
                        if ident not in seen:
                            seen.add(ident)
                            assess_product(name, str(v), 'Windows')
                        break
        except OSError:
            continue


def mac_read_plist_value(app_path):
    plist = Path(app_path) / 'Contents' / 'Info.plist'
    if not plist.exists():
        return None
    try:
        import plistlib
        with open(plist, 'rb') as f:
            data = plistlib.load(f)
        return data.get('CFBundleShortVersionString') or data.get('CFBundleVersion')
    except Exception:
        return None


def scan_macos():
    app_candidates = [
        '/Applications/Adobe Acrobat Reader.app',
        '/Applications/Adobe Acrobat.app',
        '/Applications/Adobe Acrobat DC/Adobe Acrobat.app',
        '/Applications/Adobe Acrobat Reader DC.app',
    ]

    found_any = False

    for app in app_candidates:
        if Path(app).exists():
            found_any = True
            version = mac_read_plist_value(app)
            name = Path(app).stem
            assess_product(name, version, 'macOS')

    # Try Spotlight metadata as a fallback if available
    if not found_any:
        try:
            cmd = ['mdfind', 'kMDItemCFBundleIdentifier == "com.adobe.Reader" || kMDItemCFBundleIdentifier == "com.adobe.Acrobat.Pro"']
            out = subprocess.check_output(cmd, text=True, stderr=subprocess.DEVNULL)
            for line in [x.strip() for x in out.splitlines() if x.strip()]:
                version = mac_read_plist_value(line)
                name = Path(line).stem
                assess_product(name, version, 'macOS')
                found_any = True
        except Exception:
            pass

    if not found_any:
        add_result('Adobe Acrobat/Reader', None, 'UNKNOWN', 'No known Acrobat/Reader app bundle found')


def main():
    os_name = platform.system()
    if os_name == 'Windows':
        scan_windows()
    elif os_name == 'Darwin':
        scan_macos()
    else:
        print('UNKNOWN - Unsupported OS for this check')
        sys.exit(2)

    if not RESULTS:
        print('UNKNOWN - No Adobe Acrobat/Reader installation data found')
        sys.exit(2)

    for r in RESULTS:
        print(f"{r['status']}: {r['product']} {r['version']} ({r['note']})")

    statuses = {r['status'] for r in RESULTS}
    if 'VULNERABLE' in statuses:
        print('VULNERABLE')
        sys.exit(1)
    if 'PATCHED' in statuses and statuses.issubset({'PATCHED'}):
        print('PATCHED')
        sys.exit(0)

    print('UNKNOWN')
    sys.exit(2)


if __name__ == '__main__':
    main()