This vulnerability is a Use After Free flaw in Adobe Acrobat Reader that allows an attacker to gain arbitrary code execution in the context of the current user. The fault arises when memory that has already been freed is accessed again, enabling manipulation of program flow and the execution of attacker‑supplied code. No additional exploitation steps are disclosed beyond the exploitation of the memory corruption.

Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and all earlier releases are affected. The vulnerability applies to all platforms that run these binaries, including Windows, macOS, and Linux distributions that ship the standard reader.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attack requires user interaction: a victim must open a crafted PDF file. If the user interacts with such a file, the attacker could execute code with the user's privileges. The flaw is publicly known and can potentially be exploited using readily available PDF generators without requiring additional credentials.