CVE-2014-8445: Critical – Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10

CWE Weakness Definitions

CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)

CAPEC-35 Leverage Executable Code in Non-Executable Files

via CWE-94

CAPEC-77 Manipulating User-Controlled Variables

via CWE-94

CAPEC-242 Code Injection

via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2014. A critical vulnerability affects Adobe systems (CVE-2014-8445). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2014-GLOBAL-101538-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2014-8445?

This vulnerability was disclosed in 2014. A critical vulnerability affects Adobe systems (CVE-2014-8445). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

What is the CVSS score for CVE-2014-8445?

CVE-2014-8445 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 8.9%.

Is CVE-2014-8445 actively exploited?

No confirmed active exploitation of CVE-2014-8445 as of 2026-09-25.

How do I remediate CVE-2014-8445?

Priority: MEDIUM. Advisory: http://helpx.adobe.com/security/products/reader/apsb14-28.html PSIRT: [email protected]

What systems are affected by CVE-2014-8445?

CVE-2014-8445 affects Adobe Acrobat Reader, Acrobat, Acrobat 2017, Acrobat Reader 2017; Apple Mac Os X; Microsoft Windows.

Vulnerability Details

CVE ID	`CVE-2014-8445`
BSID	`BS-2014-GLOBAL-101538-C` BreachSpider Global ID
CVSS Vector	`AV:N/AC:L/Au:N/C:C/I:C/A:C`
Published	2014-12-10
Last Modified	2026-06-17
ICS Relevance	15%
Weakness (CWE)	Code Injection
Source	NVD

Official Description

Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-8446, CVE-2014-8447, CVE-2014-8456, CVE-2014-8458, CVE-2014-8459, CVE-2014-8461, and CVE-2014-9158.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-8446, CVE-2014-8447, CVE-2014-8456, CVE-2014-8458, CVE-2014-8459, CVE-2014-8461, and CVE-2014-9158. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation Likelihood: LOW

Affected Products

Vendor	Product	Affected Versions
Adobe	Acrobat Reader	`10.0` `10.0.1` `10.0.2` `10.0.3` `10.1` `10.1.1` +21 more `10.1.2` `10.1.3` `10.1.4` `10.1.5` `10.1.6` `10.1.7` `10.1.8` `10.1.9` `10.1.10` `10.1.11` `10.1.12` `11.0.0` `11.0.01` `11.0.02` `11.0.03` `11.0.04` `11.0.05` `11.0.06` `11.0.07` `11.0.08` `11.0.09`
Adobe	Acrobat	`10.0` `10.0.1` `10.0.2` `10.0.3` `10.1` `10.1.1` +21 more `10.1.2` `10.1.3` `10.1.4` `10.1.5` `10.1.6` `10.1.7` `10.1.8` `10.1.9` `10.1.10` `10.1.11` `10.1.12` `11.0` `11.0.1` `11.0.2` `11.0.3` `11.0.4` `11.0.5` `11.0.6` `11.0.7` `11.0.8` `11.0.9`
Adobe	Acrobat 2017	`10.0` `10.0.1` `10.0.2` `10.0.3` `10.1` `10.1.1` +21 more `10.1.2` `10.1.3` `10.1.4` `10.1.5` `10.1.6` `10.1.7` `10.1.8` `10.1.9` `10.1.10` `10.1.11` `10.1.12` `11.0` `11.0.1` `11.0.2` `11.0.3` `11.0.4` `11.0.5` `11.0.6` `11.0.7` `11.0.8` `11.0.9`
Adobe	Acrobat Reader 2017	`10.0` `10.0.1` `10.0.2` `10.0.3` `10.1` `10.1.1` +21 more `10.1.2` `10.1.3` `10.1.4` `10.1.5` `10.1.6` `10.1.7` `10.1.8` `10.1.9` `10.1.10` `10.1.11` `10.1.12` `11.0.0` `11.0.01` `11.0.02` `11.0.03` `11.0.04` `11.0.05` `11.0.06` `11.0.07` `11.0.08` `11.0.09`
Apple	Mac Os X	`All versions`
Microsoft	Windows	`All versions`

Remediation

View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 4327 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`bdc099edc6d1df8d784cf78fa56e8d0570a8c4e994ff263e916e0221200116778bbe5c1fff20b8ad86ec703a7ae58285534e0163dd1336a5636b366d2d5ecddd`

Related CVEs affecting Adobe

CVE-2026-48331 10.0 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SS... CVE-2015-8408 10.0 Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on W... CVE-2015-6687 10.0 Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 ... CVE-2015-6684 10.0 Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 ... CVE-2015-0339 10.0 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 ...

View all Adobe CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →