The flaw is an improper control over object prototype attributes, a form of prototype pollution. When a malicious PDF file is opened, an attacker can trigger code that reads an arbitrary file from the victim’s local file system. The weakness is classified as CWE‑1321 and could expose sensitive data. The impact is limited to file read under the current user’s privileges, but it can still compromise confidentiality.

Adobe Acrobat Reader 26.001.21411, 24.001.30360, and 24.001.30362, along with all earlier releases, are impacted. This affects all users who have not upgraded past these revisions. The vulnerability applies to any installation of Acrobat Reader, though the operating system is not specified in the advisory.

The CVSS base score of 6.3 indicates a moderate risk level. The EPSS score is not available. The issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Exploitation requires user interaction to open a crafted PDF file, meaning the threat is user‑dependent. Because the attack is confined to local file read, the overall risk is moderate, but any environment handling PDF documents should consider patching promptly.