The vulnerability is an out-of-bounds write that allows maliciously crafted PDF files to write beyond allocated memory, enabling arbitrary code execution at the current user’s privileges. Exploitation depends on a victim opening a malicious file, so user interaction is required. The weakness falls under CWE-787.

The issue affects multiple versions of Adobe Acrobat Reader: version 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and any earlier releases. Users of these products are at risk regardless of operating system because the vulnerability is in the Reader engine itself.

The CVSS score of 7.8 indicates a high severity, and because the exploit requires that a user consciously open a crafted PDF, the effective attack vector is local user interaction. Attackers could trick victims into opening malicious files via email or the web. While the EPSS score is not available, the lack of a KEV listing suggests no confirmed public exploits yet, but the high severity warrants prompt remediation.