CVE-2014-0546KEV · OVERDUE

Adobe Reader and Acrobat Sandbox Bypass Vulnerability

High · published August 12, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.7th percentile for exploit probability.

1590
days past CISA
deadline
CVSS v3.1
8.8
EPSS
22%
Percentile
97.7
In the wild
Confirmed
What it is

🚨 A high-risk vulnerability lets attackers slip past Adobe Reader's defenses like a magician pulling off a sneaky trick! 🔥 Think of it like a secured museum with a high-tech alarm. If an outsider knows the secret code that bypasses the security system, they could walk right in and access valuable artifacts without a trace! With this vulnerability, an attacker can execute native code in a privileged context, opening the door to potentially devastating consequences. This means they could manipulate sensitive files, steal data, or even take over the system entirely!

Put simply

Think of it like a secured museum with a high-tech alarm. If an outsider knows the secret code that bypasses the security system, they could walk right in and access valuable artifacts without a trace! CVE-2014-0546 allows attackers to bypass the sandbox protection in Adobe Reader and Acrobat versions 10.x (before 10.1.11) and 11.x (before 11.0.08) on Windows through unspecified vectors, leading to unauthorized code execution.

What to do

With this vulnerability, an attacker can execute native code in a privileged context, opening the door to potentially devastating consequences. This means they could manipulate sensitive files, steal data, or even take over the system entirely! Immediate action is crucial! Update Adobe Reader and Acrobat to the latest versions (10.1.11 or 11.0.08 and above) to patch this vulnerability. Regularly check for updates to ensure continued protection against new threats. 🛡️ You've got this! Stay vigilant, take these steps, and help keep your digital world safe! 🦸‍♂️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.22330 · 97.7th percentile
Published
2014-08-12T21:00Z
KEV added
2022-05-25 · due 2022-06-15
EPSS history
Timeline
  • 25 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 15
    kev
  • 12 AUG 21:00Z
    Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently…
    cvelistv5