CVE-2017-3117 describes a critical heap overflow vulnerability within the link-handling plugin of Adobe Acrobat Reader versions 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier, impacting systems running Adobe, Apple, and Microsoft products. This vulnerability carries a CVSS v3.0 score of 8.8 (High), indicating a network-based attack with low complexity that requires user interaction, potentially leading to complete compromise of confidentiality, integrity, and availability through arbitrary code execution. While there is no evidence of active exploitation in the wild (not in KEV or Hot List), and no public exploit code (Metasploit, Nuclei, ExploitDB), its high EPSS score and media coverage suggest a notable risk. Community discussion is limited, but the vulnerability has received some media attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 11.0.0, < 11.0.21CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* | ||
>= 15.000.0000, < 15.006.30355CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* | ||
>= 17.000.0000, <= 17.011.30066CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* | ||
>= 17.000.0000, < 17.012.20098CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* | ||
>= 15.000.0000, < 15.006.30355CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.