PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2971 Adobe CVE debrief

CVE-2017-2971 is a high-severity Adobe Acrobat Reader/Acrobat memory-corruption issue in the JPEG decoder routine. The flaw can allow arbitrary code execution in affected versions when a user opens content that reaches the vulnerable parser. NVD classifies the issue as requiring user interaction and lists affected Adobe Reader/Acrobat builds up to the versions in the advisory and CPE ranges.

Vendor
Adobe
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-24
Original CVE updated
2026-05-13
Advisory published
2017-01-24
Advisory updated
2026-05-13

Who should care

Organizations running Adobe Acrobat Reader or Acrobat on endpoints that regularly open untrusted documents should care most, especially fleet administrators, SOC teams, and help desks supporting desktop PDF workflows.

Technical summary

NVD describes this as an exploitable heap overflow in Adobe's JPEG decoder routine. The published CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local execution context, no privileges required, and user interaction required. NVD's affected-product data includes Adobe Reader 11.0.18 and earlier, Acrobat/Reader DC classic up to 15.006.30244, and Acrobat/Reader DC continuous up to 15.020.20042.

Defensive priority

High. The CVSS score is 7.8 and the impact includes full confidentiality, integrity, and availability compromise, but the issue is not marked as a known exploited vulnerability in the supplied corpus.

Recommended defensive actions

  • Upgrade Adobe Acrobat Reader/Acrobat to a version newer than the affected builds listed by NVD and Adobe APSB17-01.
  • Use the Adobe security advisory reference for the exact fixed-release guidance applicable to your product branch.
  • Inventory endpoints for Reader 11.x and Acrobat/Reader DC classic or continuous tracks to confirm no versions at or below the vulnerable ranges remain deployed.
  • Treat untrusted document handling as a priority validation path during remediation verification.

Evidence notes

The supplied NVD record states the vulnerability is a heap overflow in the JPEG decoder routine and assigns CWE-119. The record also provides the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and enumerates affected Adobe version ceilings. Adobe's referenced APSB17-01 advisory and the Talos report are the official/vendor-cited references in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-2971 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-2971

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-2971 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-2971

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.