CVE-2017-11210

Adobe Acrobat can read documents, including special document types that may contain fonts. This bug is in how Acrobat processes a font inside an XPS document; a specially made document could be used to trick the software into doing something it shouldn’t (including potential malware execution) or simply causing it to crash. Think of it like a flaw in a document “decoder” that can be sabotaged by a forged file.

This matters if your business uses Adobe Acrobat/Reader and you open documents (especially ones you didn’t create yourself) that might be delivered by email, downloaded from the web, or received from partners. Because the weakness is triggered by processing a malicious XPS-embedded font, risk is tied to whether an attacker can get a crafted XPS/XPS-containing document in front of a machine running an affected version. With no CISA KEV listing and no public exploit code on record, it’s not considered broadly weaponized, but you should still patch to remove the risk.

Verdict: GREEN. There’s no CISA KEV listing and no public exploit code on record, so this isn’t confirmed as widely exploited right now. Still, update because the issue targets a file-parsing path in commonly used office viewing software.

1. Inventory and verify exposure

   • Find the Adobe Acrobat/Reader version on each workstation/server where it runs.
   • Pay special attention to machines that open documents received from email, external vendors, or the public internet.
   • Confirm whether your workflows include handling XPS files directly, or XPS-containing documents that Acrobat may parse.

2. Patch

   • Upgrade Acrobat/Reader using Adobe’s remediation for APSB17-24 (the advisory linked below describes the fix coverage for CVE-2017-11210):
     • https://helpx.adobe.com/security/products/acrobat/apsb17-24.html
   • Ensure the installed version after the upgrade is outside the affected ranges listed in the CVE record.

3. Temporary containment (if patching is delayed)

   • Treat unexpected XPS files and documents from unknown senders as risky.
   • Reduce exposure by avoiding opening untrusted attachments in Acrobat on affected versions.

4. Monitor after update

   • Check security logs for suspicious Acrobat activity around the time of any unusual document opens.
   • If you have EDR/AV telemetry, look for detections tied to Acrobat/Reader and document parsing events.

CVE-2017-11210 (CWE-119) is a memory corruption flaw in Adobe Acrobat/Reader’s font parsing when fonts are embedded in XPS (XML Paper Specification) documents. The trigger is opening a maliciously crafted document that contains such an embedded font, where the parser mishandles memory, potentially enabling arbitrary code execution. Based on findings, there is no CISA KEV entry, and no public exploit code is on record; exploitation status is therefore not confirmed as widespread. A prediction (EPSS) exists, but public blocks/urgency are driven by the lack of confirmed weaponization in the provided findings. Severity is reflected by the stated CVSS score of 6.5 (medium).