Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a stack‑based buffer overflow that can be triggered by a specially crafted file. The overflow allows an attacker to execute arbitrary code with the privileges of the user currently running Reader. This weakness is identified as CWE‑121 and represents a classic write‑overflow in local memory.

Adobe Acrobat Reader is the vendor and product affected. Versions 24.001.30365, 26.001.21651 and all earlier releases are vulnerable. Systems running any of these versions need to be evaluated for compliance with the newest update, if available.

The vulnerability has a CVSS score of 7.8, indicating high severity. EPSS information is not available, but the vulnerability is not listed in CISA KEV. Exploitation requires a user to open a malicious file, so the attack vector is user interaction via a crafted PDF or document. Because the flaw resides in a commonly installed application, the risk remains high and users should act promptly to mitigate.