Adobe Acrobat Reader contains an Untrusted Search Path vulnerability (CWE-426) in multiple versions up to and including 25.001.20982 and earlier. The issue occurs when the application uses a search path to locate critical resources such as executables, allowing an attacker to modify the search path to execute arbitrary code in the context of the current user. Successful exploitation requires the user to open a malicious file. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are currently available, and the product is not a cloud service.

An attacker who successfully exploits this vulnerability can execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the user's environment. The attack requires user interaction (opening a malicious file). The vulnerability affects confidentiality, integrity, and availability, all rated high impact by the CVSS score. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to avoid triggering this vulnerability. No official mitigation or temporary fix has been provided by Adobe as of now.