{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1497 Virtualization/Sandbox Evasion","home_page_url":"https://patchfirst.co/technique/T1497/","feed_url":"https://patchfirst.co/feed/technique/T1497.json","description":"New and newly exploited CVEs that lead to ATT&CK T1497 Virtualization/Sandbox Evasion, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-6558#kev","url":"https://patchfirst.co/cve/CVE-2025-6558/","title":"[KEV] CVE-2025-6558: Google Chromium ANGLE and GPU Improper Input Validation Vulnerability","content_text":"Google · Chromium. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 10.9% (higher than 95.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution; T1497 Virtualization/Sandbox Evasion. Priority 68.3 of 100.","summary":"Google Chromium ANGLE and GPU Improper Input Validation Vulnerability","date_published":"2025-07-22T00:00:00.000Z","date_modified":"2026-10-01T12:00:53.000Z","tags":["kev","public-exploit","T1189","T1203","T1497"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2025-07-22","ransomware":false},"epss":{"score":0.10927,"percentile":0.95873},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Google","product":"Chromium","techniqueIds":["T1189","T1203","T1497"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-2783#kev","url":"https://patchfirst.co/cve/CVE-2025-2783/","title":"[KEV] CVE-2025-2783: Google Chromium Mojo Sandbox Escape Vulnerability","content_text":"Google · Chromium Mojo. In CISA KEV since 2025-03-27. ENISA EUVD lists it as exploited. EPSS 9.2% (higher than 95.3% of CVEs). CVSS 8.3 HIGH. Public exploit code exists. ATT&CK: T1203 Exploitation for Client Execution; T1548 Abuse Elevation Control Mechanism; T1497 Virtualization/Sandbox Evasion. Priority 67.9 of 100.","summary":"Google Chromium Mojo Sandbox Escape Vulnerability","date_published":"2025-03-27T00:00:00.000Z","date_modified":"2026-06-17T09:07:37.000Z","tags":["kev","public-exploit","T1203","T1548","T1497"],"_patchfirst":{"reason":"kev","priority":67.9,"kev":{"dateAdded":"2025-03-27","ransomware":false},"epss":{"score":0.09238,"percentile":0.95345},"cvss":{"score":8.3,"severity":"HIGH","version":"3.1"},"vendor":"Google","product":"Chromium Mojo","techniqueIds":["T1203","T1548","T1497"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-0546#kev","url":"https://patchfirst.co/cve/CVE-2014-0546/","title":"[KEV] CVE-2014-0546: Adobe Reader and Acrobat Sandbox Bypass Vulnerability","content_text":"Adobe · Reader and Acrobat. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 22.3% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1068 Exploitation for Privilege Escalation; T1497 Virtualization/Sandbox Evasion. Priority 49.4 of 100.","summary":"Adobe Reader and Acrobat Sandbox Bypass Vulnerability","date_published":"2022-05-25T00:00:00.000Z","date_modified":"2026-06-17T00:03:15.000Z","tags":["kev","T1068","T1497"],"_patchfirst":{"reason":"kev","priority":49.4,"kev":{"dateAdded":"2022-05-25","ransomware":false},"epss":{"score":0.2233,"percentile":0.97684},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Reader and Acrobat","techniqueIds":["T1068","T1497"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2015-3113#kev","url":"https://patchfirst.co/cve/CVE-2015-3113/","title":"[KEV] CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-04-13. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1071.001 Web Protocols; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion. Named in 3 threat reports. Priority 77.6 of 100.","summary":"Adobe Flash Player Heap-Based Buffer Overflow Vulnerability","date_published":"2022-04-13T00:00:00.000Z","date_modified":"2026-06-17T00:25:19.000Z","tags":["kev","public-exploit","T1071.001","T1497","T1622"],"_patchfirst":{"reason":"kev","priority":77.6,"kev":{"dateAdded":"2022-04-13","ransomware":false},"epss":{"score":0.99812,"percentile":0.99959},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1071.001","T1497","T1622"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-0981","url":"https://patchfirst.co/cve/CVE-2020-0981/","title":"CVE-2020-0981: A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker…","content_text":"Microsoft · Windows 10 Version 1909 for 32-bit Systems. Not in CISA KEV. EPSS 1.3% (higher than 69.8% of CVEs). Public exploit code exists. ATT&CK: T1134 Access Token Manipulation; T1068 Exploitation for Privilege Escalation; T1497 Virtualization/Sandbox Evasion. Priority 19.0 of 100.","summary":"A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker…","date_published":"2020-04-15T00:00:00.000Z","date_modified":"2024-08-04T06:18:03.000Z","tags":["public-exploit","T1134","T1068","T1497"],"_patchfirst":{"reason":"published","priority":19,"kev":null,"epss":{"score":0.01271,"percentile":0.69812},"cvss":null,"vendor":"Microsoft","product":"Windows 10 Version 1909 for 32-bit Systems","techniqueIds":["T1134","T1068","T1497"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-8489","url":"https://patchfirst.co/cve/CVE-2018-8489/","title":"CVE-2018-8489: A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input…","content_text":"Microsoft · Windows 7. Not in CISA KEV. EPSS 4.4% (higher than 91.3% of CVEs). ATT&CK: T1497 Virtualization/Sandbox Evasion. Priority 18.3 of 100.","summary":"A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input…","date_published":"2018-10-10T00:00:00.000Z","date_modified":"2024-08-05T06:54:36.000Z","tags":["T1497"],"_patchfirst":{"reason":"published","priority":18.3,"kev":null,"epss":{"score":0.04397,"percentile":0.91306},"cvss":null,"vendor":"Microsoft","product":"Windows 7","techniqueIds":["T1497"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}