Acrobat Reader versions up to 25.001.21265 suffer from a use‑after‑free flaw that allows arbitrary code execution when a user opens a malicious PDF or file. This flaw stems from improper memory management that frees memory too early, leaving a dangling pointer that an attacker can exploit to overwrite memory contents or execute code.

The vulnerability affects Adobe Acrobat Reader Classic and Acrobat Reader DC on both Windows and macOS platforms. Specifically, versions 24.001.30307, 24.001.30308, 25.001.21265 and all earlier releases are vulnerable, placing any user who installs these versions at risk if they encounter an attacker‑crafted file.

With a CVSS score of 7.8 and an EPSS of less than 1%, the risk is high in severity but low in exploitation probability. The flaw requires active user interaction—opening a malicious file—so credential compromise or privileged execution is not needed. Adobe has issued a security patch, and users should apply the update immediately to eliminate the possibility of arbitrary code execution.