CVE-2014-8452: Adobe Acrobat

Medium severity, CVSS 5.0. EPSS: 17.6% chance of exploitation in the next 30 days.

Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected products

• Adobe Acrobat: version 10.0 only; version 10.0.1 only; version 10.0.2 only; version 10.0.3 only; version 10.1 only; version 10.1.1 only; …
• Adobe Acrobat Reader: version 10.0 only; version 10.0.1 only; version 10.0.2 only; version 10.0.3 only; version 10.1 only; version 10.1.1 only; …
• Apple Mac OS X: any version
• Microsoft Windows: any version

Published 2014-12-10. Last modified 2026-06-17.