Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a Use After Free flaw that can allow an attacker to execute arbitrary code with the privileges of the current user. The vulnerability arises when a maliciously crafted file is opened, freeing memory that is later accessed, leading to a potentially complete compromise of the user session.

The affected product is Adobe Acrobat Reader, specifically any deployment on or prior to versions 24.001.30365 and 26.001.21651. All earlier builds share the same code path that liberates memory before use.

The CVSS score of 7.8 indicates a high severity, but the exploitation requires user interaction; the attacker must convince a victim to open a malicious document. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale, automated exploitation is not yet documented. Nonetheless, once a user opens a malicious PDF, the attacker can achieve arbitrary code execution in that user’s context, representing a serious threat if the user has elevated or sensitive access.