Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-16416: Adobe Acrobat and Reader may let attackers run code

CVE-2017-16416 · published 8 years ago

Summary

Certain older versions of Adobe Acrobat and Acrobat Reader can be tricked into mishandling specially crafted image files, which could let a malicious user run their own programs or corrupt data on your computer. This affects the 2017, 2015, and 11.0.22 releases and earlier. Update to the latest Adobe Acrobat/Reader versions as soon as possible to protect yourself.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
adobe	acrobat	<= 11.0.22 >= 17.0, <= 17.011.30066 `cpe:2.3:a:adobe:acrobat::::::::`
adobe	acrobat_dc	>= -, <= 17.012.20098 >= 15.0, <= 15.006.30355 `cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*`
adobe	acrobat_reader	<= 11.0.22 >= 17.0, <= 17.011.30066 `cpe:2.3:a:adobe:acrobat_reader::::::::`
adobe	acrobat_reader_dc	>= -, <= 17.012.20098 >= 15.0, <= 15.006.30355 `cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*`

Original advisory text

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a computation that writes data past the end of the intended buffer; the computation is part of the image conversion module that handles Enhanced Metafile Format Plus (EMF+) data. The vulnerability is a result of an out of range pointer offset that is used to access sub-elements of an internal data structure. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.

References

http://www.securityfocus.com/bid/101812 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039791 Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb17-36.html Broken Link

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

11% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published9 Dec 2017

Updated18 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-16416 · NVD

Track software like this

Free during beta