Product:
Acrobat Reader
Summary
Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-27220 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim using the affected version of Acrobat Reader, triggers the Use After Free condition. This requires the victim to be tricked into opening the file, which can be delivered through various means such as email attachments or downloads from compromised websites.
Affected Products
- Acrobat Reader 24.001.30307 and earlier: Vulnerable to Use After Free leading to arbitrary code execution.
- Acrobat Reader 24.001.30308 and earlier: Same vulnerability as above.
- Acrobat Reader 25.001.21265 and earlier: Also affected by the Use After Free issue.
Mitigation
To mitigate this vulnerability, users should update to the latest version of Acrobat Reader as soon as possible. Additionally, users should avoid opening files from untrusted sources and consider implementing security measures such as file scanning and email filtering to reduce the risk of exposure.