Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain an out‑of‑bounds read flaw that allows a malicious PDF to cause the application to read memory outside the intended bounds. This flaw can expose sensitive data such as personal information or cryptographic keys that the application holds while running. The vulnerability is classified as CWE‑125 and does not enable arbitrary code execution; it merely leaks data that could be used in broader attacks.

Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and all earlier releases are impacted by this vulnerability.

The CVSS score of 5.5 indicates a medium severity risk; the EPSS score is unavailable, so the current exploitation probability is unknown. Exploitation requires user interaction, as the attacker must deliver a malicious PDF that the victim opens. Disclosure of memory contents could compromise confidentiality. The flaw is not listed in CISA’s KEV catalog, suggesting no known public exploitation at the time of assessment.