CVE-2014-0496: Adobe Reader and Acrobat Use-After-Free Vulnerability

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: yes — in CISA KEV since 2022-03-03
EPSS: 40.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-15 · updated 2026-06-17
Weakness: CWE-416

Description

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.

Affected products

Adobe Acrobat for Edge: from 10.0 before 10.1.9; from 11.0 before 11.0.6 — fixed in 10.1.9, 11.0.6

How to fix

Upgrade to a fixed version: Adobe Acrobat for Edge 10.1.9, 11.0.6. Check the vendor advisory for mitigations.

References

http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
http://www.securitytracker.com/id/1029604
http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
http://www.securitytracker.com/id/1029604
https://github.com/cisagov/vulnrichment/issues/199
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0496

Get alerted when CVE-2014-0496 or the next vulnerability affects your stack