Adobe Acrobat and Reader contain an out‑of‑bounds read flaw that allows a malicious document to read memory beyond the intended buffer, exposing sensitive information. The vulnerability is triggered when a user opens a crafted file; it does not lead to code execution or denial of service, but it can leak private data that the victim’s system holds at runtime. The weakness is a Classic Buffer Overread (CWE‑125).

Affected versions include Adobe Acrobat and Reader 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier. All releases within the Adobe:Acrobat Reader product line that fall into these version ranges are impacted.

The CVSS score of 5.5 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is unavailable, suggesting limited known exploitation activity. Exploitation requires the victim to open a malicious PDF, making the attack dependent on social engineering or compromised environments. The main risk is a confidentiality breach through memory disclosure rather than active compromise.