CVE-2017-16413

CVE-2017-16413 is a critical out-of-bounds write vulnerability affecting Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier. This flaw occurs within the XPS to PDF conversion module when processing TIFF files, specifically due to an out-of-range pointer offset that leads to data being written past its intended buffer. Rated with a CVSS score of 8.8 (High), this vulnerability can be exploited remotely with low attack complexity, requiring user interaction (e.g., opening a malicious TIFF file). Successful exploitation could lead to arbitrary code execution or corruption of sensitive data, posing a significant risk to confidentiality, integrity, and availability. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered some community discussion and media coverage. It is not listed in CISA's KEV catalog, and its EPSS score is relatively low, suggesting a lower probability of future exploitation compared to many other CVEs.