A Use‑After‑Free flaw in Adobe Acrobat Reader, disclosed as CVE-2026-47914, allows an attacker to execute arbitrary code in the context of the user who opens a crafted PDF file. The vulnerability arises when the application frees memory prematurely and later accesses it again, providing a path for code injection. If triggered, the attacker can gain the same privileges as the current user, potentially leading to data theft, system compromise, or further lateral movement.

Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and all earlier releases are affected. No other vendors or products are listed as impacted.

The CVSS score of 7.8 indicates a high severity, EPSS is not provided, and the vulnerability is not listed in CISA KEV, meaning it has not yet been widely exploited. The likely attack vector requires the victim to open a malicious PDF file, after which the flaw can be exploited to execute arbitrary code in the user’s context. The combination of high severity and the user‑interaction prerequisite places this vulnerability in a high‑risk category for environments with loose document‑handling policies.