PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2974 Adobe CVE debrief

CVE-2017-2974 affects Adobe Digital Editions versions 4.5.3 and earlier. The official CVE description says successful exploitation could lead to information disclosure, while the NVD record classifies the flaw as CWE-125 and gives it a 7.5 High CVSS score. From a defensive standpoint, this is a serious issue for any environment that still runs affected Adobe Digital Editions builds, especially because the NVD vector indicates network reachability with no privileges and no user interaction.

Vendor
Adobe
Product
Digital Editions
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

Organizations and users running Adobe Digital Editions 4.5.3 or earlier, especially endpoint teams responsible for desktop software inventory, patching, and document-handling environments.

Technical summary

The NVD record identifies the issue as a buffer over-read (CWE-125) in Adobe Digital Editions through version 4.5.3. The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating low-complexity, unauthenticated, network-reachable attack conditions according to the record. The CVE description separately states that successful exploitation could lead to information disclosure. The source material does not provide exploitation steps or a confirmed fixed version, so remediation should follow Adobe’s vendor advisory.

Defensive priority

High

Recommended defensive actions

  • Inventory Adobe Digital Editions installations and identify any systems running version 4.5.3 or earlier.
  • Apply the remediation guidance in Adobe advisory APSB17-05 and update to a non-vulnerable version.
  • If immediate patching is not possible, restrict or remove exposed installations from sensitive endpoints until updated.
  • Validate remediation by confirming the installed Adobe Digital Editions version is newer than 4.5.3.
  • Review any handling of sensitive documents on affected endpoints for potential exposure risk until the update is deployed.

Evidence notes

This debrief is based only on the supplied CVE record and NVD metadata. The corpus states Adobe Digital Editions versions 4.5.3 and earlier are affected, identifies CWE-125, provides CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and links to Adobe’s APSB17-05 advisory. The CVE description says exploitation could lead to information disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-2974 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-2974

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-2974 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-2974

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.