The vulnerability is an out‑of‑bounds write in Adobe Acrobat Reader that can lead to arbitrary code execution when a malicious PDF file is opened. The flaw occurs during file parsing and allows memory corruption, enabling an attacker to run arbitrary code in the context of the current user, potentially installing malware or escalating privileges.

Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and all earlier releases are affected. Users of these versions on any supported platform should be aware.

The CVSS score of 7.8 indicates high severity, but EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation probability remains uncertain. Exploitation requires the victim to open a crafted PDF, meaning attack vectors are limited to user interaction; however, this still poses significant risk to users exposed to untrusted documents.