CVE-2014-0546 used in targeted attacks

Adobe Reader and Acrobat on Windows contain a sandbox bypass (CVE-2014-0546) in which an attacker can defeat the application's sandbox protection mechanism and execute native code in a privileged context. The source data does not specify the exact trigger, but PDF-reader sandbox escapes are normally exploited by getting a user to process attacker-supplied PDF content and are typically chained with a PDF-parsing bug to reach full code execution outside the sandbox. Successful exploitation gives an attacker native code execution beyond the sandbox's restrictions, materially increasing the impact of any accompanying PDF exploit. Only Windows installations of Adobe Reader and Acrobat are identified as affected in the available data. The flaw is known to be exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25 (ransomware use unknown), EPSS estimates a 22.3% probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known.

Do: Inventory Windows endpoints for Adobe Reader and Acrobat and update them to the latest patched release per Adobe's security bulletin, per CISA's required action (patching is mandatory for U.S. federal agencies given the KEV listing). Because the flaw defeats the sandbox itself, there is no strong configuration-only mitigation, so patching is the primary control; prioritize endpoints that open untrusted PDFs and verify afterwards that no legacy unpatched builds remain.