CVE-2014-0496highunder attackCWE-416

CVE-2014-0496

Published · Updated

Follow this CVE+ Monitor Adobe Acrobat+ Monitor Reader Mobile

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 40%
from disclosure to weapon
Published on NVDJan 15
CISA KEV+2969d
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

Adobe Reader and Acrobat versions 10 and 11 contain a use-after-free flaw that allows attackers to run malicious code on your computer. This happens because the software tries to use memory that has already been freed, which attackers can exploit through specially crafted files.

Technical detail

Use-after-free vulnerability in Adobe Reader/Acrobat 10.x (before 10.1.9) and 11.x (before 11.0.06) on Windows and macOS allows remote code execution via unspecified attack vectors. The vulnerability stems from improper memory management where freed memory is subsequently accessed, enabling arbitrary code execution with user interaction (opening a malicious PDF or similar file).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a