CVE-2017-16392: Adobe Acrobat

High severity, CVSS 8.8. EPSS: 12.8% chance of exploitation in the next 30 days.

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer access with an incorrect length value in the JPEG processing module. Crafted input with an unexpected JPEG file segment size causes a mismatch between allocated buffer size and the access allowed by the computation. If an attacker can adequately control the accessible memory then this vulnerability can be leveraged to achieve arbitrary code execution.

Affected products

• Adobe Acrobat: up to and including 11.0.22; from 17.0, up to and including 17.011.30066
• Adobe Acrobat DC: from -, up to and including 17.012.20098; from 15.0, up to and including 15.006.30355
• Adobe Acrobat Reader: up to and including 11.0.22; from 17.0, up to and including 17.011.30066
• Adobe Acrobat Reader DC: from -, up to and including 17.012.20098; from 15.0, up to and including 15.006.30355

Published 2017-12-09. Last modified 2026-06-17.