Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a Use After Free flaw that allows an attacker to execute arbitrary code in the context of the current user. The flaw arises when an object is freed and an attacker can access the memory again, resulting in memory corruption and code execution. This vulnerability is classified as CWE‑416.

The affected systems are installations of Adobe Acrobat Reader for the listed versions: 24.001.30365, 26.001.21651 and any earlier releases. Systems running newer releases are not affected by this issue.

The CVSS score of 7.8 indicates a serious risk level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, which suggests it is not a known, actively exploited vulnerability at this time. Exploitation requires user interaction – the victim must open a malicious file. The attack vector is thus user‑initiated, and while the likelihood of successful exploitation is uncertain, the potential for arbitrary code execution makes it a high‑importance concern for environments where users may inadvertently open compromised PDFs.