The vulnerability is a Use After Free flaw that allows an attacker to execute arbitrary code in the context of the user who opens a malicious PDF. Once the memory that has been freed is accessed, the attacker can inject code that runs with the privileges of the current user. This weakness is identified as CWE‑416 and requires user interaction to trigger.

Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and all earlier releases are affected. The vulnerability is specific to the Acrobat Reader product line from Adobe.

The CVSS score of 7.8 indicates a serious risk, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to open a malicious file, so the attack vector is user interaction with crafted PDF content. With no EPSS data available, the likelihood of current exploitation cannot be quantified, but the impact and required user action suggest a high priority for patching.