Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and all earlier releases contain an out‑of‑bounds read that can expose the contents of memory that the software should not access. The vulnerability could allow an attacker to read sensitive information after a user opens a specially crafted PDF file, but it requires the user to interact with the file. The primary consequence is the potential disclosure of confidential data, which could compromise privacy and business secrets.

Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and all earlier releases are affected. Users of this product running those versions are at risk.

The CVSS v3.1 base score is 5.5, indicating moderate severity. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, which suggests there has been no widespread exploitation to date. Exploitation requires a malicious PDF to be opened by a user, so the attack vector is User Interaction with a crafted document. Although an attacker must supply the payload, the impact of a successful exploit is non‑trivial due to the potential disclosure of memory contents.