Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier contain an uncontrolled search path element vulnerability that can allow an attacker to cause arbitrary code execution when a user opens a malicious file. The flaw involves a flaw in how Acrobat builds its execution paths, leading to a change in scope and granting the attacker the same privileges as the current user. The weakness is a classic example of CWE‑427.

The affected product is Adobe Acrobat Reader for all operating systems that shipped the specified versions. Users running any of the listed release numbers, or earlier releases that share the same code base, are at risk until they upgrade to a patched revision provided by Adobe.

This vulnerability has a CVSS score of 7.4 and is not listed in the CISA KEV catalog. No EPSS score is available, indicating the exploit probability is not quantified. Because the exploit requires user interaction to open a malicious file, it is an exploitation scenario that relies on social engineering or phishing. Nevertheless, once the vulnerability is triggered, the attacker can execute arbitrary code with the victim's user rights, potentially escalating privileges if the victim has administrative rights. The absence of a KEV listing does not negate the need to patch promptly, as the CVSS score signals a substantial risk.