An out-of-bounds read exists in Adobe Acrobat Reader that can expose sensitive data stored in memory. The weakness is a classic read-from-unknown-memory-region error that may leak private information but does not provide code execution or other privilege escalation. Attackers can obtain excerpts of memory contents if they can trick a user into processing a crafted file.

Adobe Acrobat Reader releases 24.001.30365, 26.001.21651 and all earlier versions are vulnerable. Any installation of these versions that processes untrusted PDFs or other supported file types is at risk.

The CVSS score of 5.5 indicates a moderate impact. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction: a victim must open a malicious document. Consequently, the likelihood of exploitation depends heavily on user behavior and the prevalence of malicious PDFs.