Adobe Acrobat Reader contains a use‑after‑free flaw that allows a crafted PDF to trigger a memory access to freed memory, enabling the attacker to execute arbitrary code in the context of the opening user. This vulnerability, defined as CWE‑416, can compromise the confidentiality, integrity, or availability of the user’s device. The flaw is specifically tied to the handling of PDF content and does not provide an attacker with elevated privileges beyond the current user context.

The vulnerability affects Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and all earlier releases of these major versions. Any installation of Adobe Acrobat Reader built on those product lines is potentially vulnerable.

The CVSS score of 7.8 places this issue in the High severity range, reflecting the potential for arbitrary code execution. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is currently unknown, but the requirement that a user open a malicious PDF makes it a user interaction scenario. Attackers could craft a PDF that, when opened by a target, triggers the use‑after‑free condition and runs arbitrary code with the user’s privileges.