The flaw can cause a crash and may allow an attacker to take control of the affected system. There are reports the bug is being actively exploited, Adobe said in a security advisory.

A patch won’t be released until January 12, which is when the next regular security update is scheduled.

In the meantime, Adobe says customers using Adobe Reader or Acrobat versions 9.2 or 8.1.7 can utilize the JavaScript Blacklist Framework to prevent this vulnerability.

Other users can mitigate the risk by disabling JavaScript in Acrobat and Reader. Instructions:

1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the “Enable Acrobat JavaScript” option
5. Click OK