CVE-2017-3120

HIGH

Adobe Acrobat < 11.0.21 - Use After Free

Title source: rule

Description

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA parsing engine when handling certain types of internal instructions. Successful exploitation could lead to arbitrary code execution.

References (3)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/100182

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1039098

[Patch, Vendor Advisory] https://helpx.adobe.com/security/products/acrobat/apsb17-24.html

Scores

CVSS v3 8.8

EPSS 0.0510

EPSS Percentile 89.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-416

Status draft

Affected Products (6)

adobe/acrobat < 11.0.21

adobe/acrobat_dc < 15.006.30355

adobe/acrobat_dc < 17.012.20098

adobe/acrobat_reader_dc < 15.006.30355

adobe/acrobat_reader_dc < 17.012.20098

adobe/reader < 11.0.21

Timeline

Published Aug 11, 2017

Tracked Since Feb 18, 2026