This vulnerability is a use‑after‑free flaw that allows an attacker to read sensitive data from memory after Adobe Acrobat Reader processes a malicious PDF file. The exposed memory can contain confidential information, and exploitation leads to disclosure of that data. According to the description, it requires the victim to open the crafted file, so the attack tree is limited to files that can be delivered to or accessed by the user.

Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and all earlier releases are affected. Users running any of these builds are vulnerable if they encounter malicious PDF documents.

The CVSS score of 5.5 classifies this as a moderate severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation demands the victim open a malicious file, so the vector is typically user‑initiated via phishing, file sharing or compromised websites. Once the file is opened, the use‑after‑free can leak memory contents to the attacker.