Microsoft Update Tuesday: January 2014, fix for the XP/2003 0

Adobe Reader and Acrobat contain a memory corruption vulnerability (CWE-119, buffer/pointer handling error) that can allow an attacker to execute arbitrary code or crash the application. The bug is triggered by processing maliciously crafted content, typically when a user opens a booby-trapped PDF document. Successful exploitation yields arbitrary code execution with the privileges of the logged-in user, while failed exploitation can cause a denial of service. Anyone running affected Adobe Reader or Acrobat installations is exposed, with desktop users who open PDFs from email or the web at greatest risk. The flaw has been exploited in the wild: CISA added it to the KEV catalog on 2022-03-03 and it carries a very high EPSS score of 78.6%, although no public proof-of-concept is known.

Do: Apply vendor-supplied updates to Adobe Reader and Acrobat immediately, per the Adobe security bulletin and the CISA KEV required action, and retire or upgrade legacy unpatched builds that are past end of support. Because exploitation requires a user to open a crafted PDF, inspect or sandbox PDFs at email and web gateways and hunt for signs of PDF exploit delivery; treat this flaw as actively exploited given the KEV listing and 78.6% EPSS.

CVE-2013-5065 is a local privilege escalation flaw caused by improper input validation (CWE-20) in NDProxy.sys, a kernel driver in Microsoft Windows. A local attacker triggers the flaw by sending malformed input that reaches the vulnerable kernel driver, bypassing the usual validation checks. Successful exploitation allows the attacker to run code with elevated (kernel/SYSTEM-level) privileges, typically taking full control of the local machine from a limited-user foothold. Per CISA, Microsoft Windows is affected; no specific version ranges are provided in the source data, so defenders should consult vendor update guidance for scope. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating it is known to be exploited in the wild, though ransomware use is listed as unknown and no public PoC is catalogued.

Do: Apply the Microsoft updates per vendor instructions as required by CISA's KEV listing, prioritizing systems that host interactive users or are entry points in your environment. Because this is a local privilege escalation, focus on limiting local/low-privileged access on Windows hosts and confirm via vendor advisories which Windows versions are in scope and patched. Treat this KEV entry as a patching priority given the confirmed in-the-wild exploitation status.