Adobe Acrobat Reader versions 24.001.30365, 26.001.21651, and earlier contain a heap-based buffer overflow that can lead to arbitrary code execution. The flaw is a classic use of uncontrolled memory writes (CWE‑122) and can compromise confidentiality, integrity, and availability of the victim’s system if executed. The vulnerability requires the current user to open a specially crafted PDF file, so the primary impact is local to the user’s session.

Adobe Acrobat Reader, specifically the versions listed above. Any installation of Acrobat Reader on these or earlier releases is affected.

The CVSS score of 7.8 indicates a moderate to high severity, and the reported EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a social‑engineering based approach in which the victim is persuaded to open a malicious PDF file. If such a file is executed, an attacker could run arbitrary code with the victim’s privileges. Currently no public exploit is documented, but the presence of the vulnerability warrants caution.