Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

The affected product is Adobe Acrobat Reader for all operating systems that shipped the specified versions. Users running any of the listed release numbers, or earlier releases that share the same code base, are at risk until they upgrade to a patched revision provided by Adobe.

This vulnerability has a CVSS score of 7.7 and is not listed in the CISA KEV catalog. Its EPSS score is < 1%, indicating the exploit probability is low. Because the exploit requires user interaction to open a malicious file, the attack likely involves user interaction such as social engineering or phishing; however, this inference is based on the description and not explicitly stated in the CVE data. Once triggered, the attacker can execute arbitrary code with the victim's user rights, potentially escalating privileges if the victim has administrative rights. The absence of a KEV listing does not negate the need to patch promptly, as the CVSS score signals a substantial risk.