Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Adobe Digital Editions may let attackers run any code

CVE-2017-3092 · published 9 years ago
Summary

Versions of Adobe Digital Editions up through 4.5.4 can load a component in an unsafe way, which could let a malicious program run any code on a computer during installation. This could let attackers take control of the system. Update to a newer version of Digital Editions or apply the vendor’s fix to protect your devices.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe digital_editions <= 4.5.4
cpe:2.3:a:adobe:digital_editions:*:*:*:*:*:*:*:*
Original advisory text
Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of editor control library functions in the in...
Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of editor control library functions in the installer plugin. A successful exploitation could lead to arbitrary code execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
8% chance of attack within 30 days
Type
CWE-427Uncontrolled Search Path Element
Timeline
Published20 Jun 2017
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-3092 · NVD
Track software like this
Free during beta