CVE-2014-0496KEV · OVERDUE

Adobe Reader and Acrobat Use-After-Free Vulnerability

High · published January 15, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
8.8
EPSS
40%
Percentile
98.6
In the wild
Confirmed
What it is

🚨 A classic use-after-free vulnerability in Adobe Reader could let attackers run arbitrary code — like a hacker finding a forgotten key to your digital house! 🔥 Think of it like a delivery driver getting lost because they still have the old address on their GPS. Once they free up that old route, they can head straight to an entirely different destination — and that’s where the trouble starts! An attacker exploiting this flaw could execute any code they choose, potentially allowing them to take control of your system, steal sensitive data, or wreak havoc on your files. If you're using an affected version, the risks are nothing short of catastrophic! ⚡

Put simply

Think of it like a delivery driver getting lost because they still have the old address on their GPS. Once they free up that old route, they can head straight to an entirely different destination — and that’s where the trouble starts! This use-after-free vulnerability in Adobe Reader and Acrobat occurs when the application fails to properly manage memory, allowing an attacker to run malicious code through unspecified vectors. This affects versions 10.x before 10.1.9 and 11.x before 11.0.06 on both Windows and Mac OS X.

What to do

An attacker exploiting this flaw could execute any code they choose, potentially allowing them to take control of your system, steal sensitive data, or wreak havoc on your files. If you're using an affected version, the risks are nothing short of catastrophic! ⚡ To protect yourself, update Adobe Reader and Acrobat to version 10.1.9 or 11.0.06 or later immediately. Additionally, consider disabling JavaScript in Adobe Reader as an extra precaution and regularly check for updates to keep your software secure! 🛡️ You've got this! Following these steps will help you secure your system and keep those digital intruders at bay! 😄

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.39980 · 98.6th percentile
Published
2014-01-15T02:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 15 JAN 02:00Z
    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute…
    cvelistv5