Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a use–after–free flaw (CWE–416) that can lead to arbitrary code execution in the context of the user who opens a malicious file. The vulnerability arises when the application reuses memory after it has been freed, allowing attackers to trigger arbitrary code execution.

Adobe Acrobat Reader is the affected product, specifically the versions listed above and any earlier releases that have not received an update. Systems running these vulnerable releases are exposed to the described exploitation risk.

With a CVSS score of 7.8 the vulnerability is considered high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, which suggests limited publicly known exploitation but still significant risk. Exploitation requires user interaction, i.e., the victim must open a malicious PDF file. The likely attack vector is phishing or drive‑by download of malicious PDFs, inferring that attackers rely on enticing users to view compromised documents.