Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and all earlier releases are vulnerable to an untrusted search path flaw (CWE‑426). When the operating system’s search path for locating critical resources is manipulated, the application may load a malicious program in place of a legitimate one. If a user opens a crafted file, the victim’s current privileges are abused and arbitrary code can execute within that user context, allowing full control of the client machine.

Affected systems include Adobe Acrobat Reader on both Windows and macOS. The vulnerable variants are the classic and continuous distribution channels, covering Adobe Acrobat, Adobe Acrobat DC, and Adobe Acrobat Reader. All listed versions and any earlier releases that remain unpatched are susceptible.

The CVSS base score of 7.8 indicates a high‑severity vulnerability, while the EPSS score of < 1 % reflects a low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires user interaction; an attacker must convince the user to open a malicious file, often via phishing or social engineering, after which the manipulated search path allows execution of arbitrary code. The principal risk is that an unsuspecting user who opens an infected PDF or similar document could hand over control of the client machine to an attacker.