CVE-2014-0546

Adobe Reader and Acrobat: Sandbox Bypass

As of , CVE-2014-0546 in Adobe Reader and Acrobat is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.

Exploited
Yes: CISA listed it on 25 May 2022
US federal deadline
15 June 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.22Higher than 97% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.01 on 25 May 2022EPSS on the day CISA listed it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.

CISA's description

Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors.

The CVE record's description, from adobe

CVE published
12 August 2014
Assigned by
adobe
CVSS
8.8 High (CVSS 3.1, from CISA-ADP)
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Renamed from Acrobat and Reader to Reader and Acrobat. Edited: description and name.

Reader and Acrobat: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2011-2462Universal 3D Memory CorruptionAdobe Reader and AcrobatPatch this weekMetasploit module; EPSS 0.89; verified Exploit-DB entry0.89
CVE-2009-0927Reader and Adobe Acrobat Stack-Based Buffer OverflowAdobe Reader and AcrobatPatch this weekMetasploit module; EPSS 0.97; verified Exploit-DB entry0.97
CVE-2010-0188Arbitrary Code ExecutionAdobe Reader and AcrobatPatch this weekRansomware use; Metasploit module; EPSS 0.88; verified Exploit-DB entry0.88
CVE-2013-3346Memory CorruptionAdobe Reader and AcrobatPatch this weekMetasploit module; EPSS 0.79; verified Exploit-DB entry0.79
CVE-2013-0640Memory CorruptionAdobe Reader and AcrobatPatch this weekEPSS 0.87; verified Exploit-DB entry0.87
CVE-2013-2729Arbitrary Integer OverflowAdobe Reader and AcrobatPatch this weekEPSS 0.670.67
CVE-2014-0496Use-After-FreeAdobe Reader and AcrobatPatch soon0.40

Read further