CVE-2017-11308

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-19 · updated 2026-06-17
Weakness: CWE-787

Description

Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Affected products

Adobe Acrobat for Edge: from 11.0.0 through 11.0.22; from 17.011.30066 before 17.011.30068 — fixed in 17.011.30068
Adobe Acrobat DC: from 15.006.30355 before 15.006.30392; from 17.012.20098 before 18.009.20044 — fixed in 15.006.30392, 18.009.20044
Adobe Acrobat Reader: from 11.0.0 through 11.0.22; from 17.011.30066 before 17.011.30068 — fixed in 17.011.30068
Adobe Acrobat Reader: from 15.006.30355 before 15.006.30392; from 17.012.20098 before 18.009.20044 — fixed in 15.006.30392, 18.009.20044

How to fix

Upgrade to a fixed version: Adobe Acrobat for Edge 17.011.30068; Adobe Acrobat DC 15.006.30392, 18.009.20044; Adobe Acrobat Reader 17.011.30068; Adobe Acrobat Reader 15.006.30392, 18.009.20044. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-11308 or the next vulnerability affects your stack