PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2971 Adobe CVE debrief

CVE-2017-2971 is a high-severity Adobe Acrobat Reader/Acrobat memory-corruption issue in the JPEG decoder routine. The flaw can allow arbitrary code execution in affected versions when a user opens content that reaches the vulnerable parser. NVD classifies the issue as requiring user interaction and lists affected Adobe Reader/Acrobat builds up to the versions in the advisory and CPE ranges.

Vendor
Adobe
Product
CVE-2017-2971
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-24
Original CVE updated
2026-05-13
Advisory published
2017-01-24
Advisory updated
2026-05-13

Who should care

Organizations running Adobe Acrobat Reader or Acrobat on endpoints that regularly open untrusted documents should care most, especially fleet administrators, SOC teams, and help desks supporting desktop PDF workflows.

Technical summary

NVD describes this as an exploitable heap overflow in Adobe's JPEG decoder routine. The published CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local execution context, no privileges required, and user interaction required. NVD's affected-product data includes Adobe Reader 11.0.18 and earlier, Acrobat/Reader DC classic up to 15.006.30244, and Acrobat/Reader DC continuous up to 15.020.20042.

Defensive priority

High. The CVSS score is 7.8 and the impact includes full confidentiality, integrity, and availability compromise, but the issue is not marked as a known exploited vulnerability in the supplied corpus.

Recommended defensive actions

  • Upgrade Adobe Acrobat Reader/Acrobat to a version newer than the affected builds listed by NVD and Adobe APSB17-01.
  • Use the Adobe security advisory reference for the exact fixed-release guidance applicable to your product branch.
  • Inventory endpoints for Reader 11.x and Acrobat/Reader DC classic or continuous tracks to confirm no versions at or below the vulnerable ranges remain deployed.
  • Treat untrusted document handling as a priority validation path during remediation verification.

Evidence notes

The supplied NVD record states the vulnerability is a heap overflow in the JPEG decoder routine and assigns CWE-119. The record also provides the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and enumerates affected Adobe version ceilings. Adobe's referenced APSB17-01 advisory and the Talos report are the official/vendor-cited references in the source corpus.

Official resources

Publicly disclosed on 2017-01-24 per the supplied CVE publication timestamp. The supplied NVD record was last modified on 2026-05-13.