Buffer Access Vulnerability in Adobe Acrobat and Reader
CVE-2017-16395

8.8HIGH

Key Information:

Vendor: Adobe
Status: Adobe Acrobat Reader 2017.012.20098 And Earlier Versions, 2017.011.30066 And Earlier Versions, 2015.006.30355 And Earlier Versions, 11.0.22 And Earlier Versions
Vendor: CVE Published:; 9 December 2017

Summary

A vulnerability exists in Adobe Acrobat and Reader versions up to 2017.012.20098 that is caused by improper handling of buffer lengths in the image conversion module. This flaw arises when processing Enhanced Metafile Format (EMF) files through the EMR_STRETCHDIBITS command, where an attacker can exploit a mismatch between the allocated buffer size and the expected access, potentially allowing for arbitrary code execution if the attacker has control over the input fed to the application.

Affected Version(s)

Adobe Acrobat Reader 2017.012.20098 and earlier , 2017.011.30066 and earlier , 2015.006.30355 and earlier , 11.0.22 and earlier Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions