CVE-2017-11237 describes a critical memory corruption vulnerability in the font parsing module of Adobe Acrobat Reader versions 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier, impacting users on Adobe, Apple, and Microsoft platforms. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk where an unauthenticated attacker could achieve arbitrary code execution with low attack complexity, requiring user interaction. While the vulnerability is not listed in CISA's KEV catalog and no public exploit code is readily available (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, suggesting awareness within the security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 11.0.0, <= 11.0.20CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* | ||
>= 17.011.00000, <= 17.011.30066CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* | ||
>= 15.006.30060, <= 15.006.30306CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* | ||
>= 15.007.20033, <= 17.009.20058CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* | ||
>= 17.011.00000, <= 17.011.30066CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.