A bug in Adobe Acrobat for Edge allows an attacker to trigger an out‑of‑bounds write, which can lead to arbitrary code execution when a user opens a crafted file. The flaw arises from improper bounds checking of a file‑input buffer, and any code executed under the victim’s user account can be used to compromise the system. The impact is therefore local code execution that can be leveraged to gain control over the victim’s machine, enabling further attacks or data theft.

The vulnerability affects the Adobe Acrobat for Edge component integrated into Microsoft Edge. No specific version numbers are listed, so all versions that have not yet been updated with the advisory should be considered vulnerable.

The CVSS score of 8.8 indicates a high‑severity issue. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction – a malicious file must be opened – so the attack vector is local via the file system. While no public exploit is known, the lack of EPSS data does not reduce the importance of applying the fix promptly, especially for environments that process untrusted documents.