Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a Use After Free flaw that can allow an attacker to execute arbitrary code in the context of the current user. The vulnerability arises when memory is freed and then accessed again, permitting the injection of malicious code. Because the flaw requires a malicious file to be opened, the impact is limited to interaction with the user but still enables a potentially full compromise of the affected system.

The affected products are Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and all earlier releases. Users running these versions are vulnerable until the software is updated to a fixed release.

The CVSS score of 7.8 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting it is not yet widely exploited in the wild. The launch vector is user interaction: a victim must open a specially crafted file. Once the file is processed, the use‑after‑free can be triggered, giving the attacker code execution with the current user's privileges.