CVE-2014-0496
Published 2014-01-15 · Updated 2026-06-17 · Source psirt@adobe.com
Summary
CVE-2014-0496 is a high-severity (CVSS 8.8) vulnerability in Adobe Reader and Acrobat. CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 24, 2022. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Adobe — Reader and Acrobat
Name: Adobe Reader and Acrobat Use-After-Free Vulnerability
Date added: 2022-03-03 · Due: 2022-03-24
Required action: Apply updates per vendor instructions.
References
- http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
- http://www.securitytracker.com/id/1029604
- http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
- http://www.securitytracker.com/id/1029604
- https://github.com/cisagov/vulnrichment/issues/199
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0496