CVE-2017-11244

Exploitation likely. EPSS gives it a 10% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.06.5Medium EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2017-08-11Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Adobe Systems Incorporated Acrobat ReaderAffected: 2017.009.20058 and earlierUpgrade to: not statedAffected: 2017.008.30051 and earlierUpgrade to: not statedAffected: 2015.006.30306 and earlierUpgrade to: not statedAffected: 11.0.20 and earlierUpgrade to: not statedStated by: CVE record
Adobe AcrobatAffected: ≥ 11.0.0, ≤ 11.0.20Upgrade to: after 11.0.20Affected: ≥ 17.011.00000, ≤ 17.011.30066Upgrade to: after 17.011.30066Stated by: NVD
Adobe Acrobat DcAffected: ≥ 15.006.30060, ≤ 15.006.30306Upgrade to: after 15.006.30306Stated by: NVD
Adobe ReaderAffected: ≥ 11.0.0, ≤ 11.0.20Upgrade to: after 11.0.20Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which exact product and version you run (Acrobat Reader or Acrobat, including whether it’s the 2017.x line or 11.x).
Compare your version to the affected ones: 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier.
If you match any affected version, install the fixed update provided by Adobe in APSB17-24 (update Acrobat Reader/Acrobat DC from that advisory).
After updating, re-check the application version to confirm it changed from the affected range.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to transformation of blocks of pixels. Successful exploitation could lead to arbitrary code execution.

In plain language

Written by AI from the record

This is a bug in Adobe Acrobat Reader/Acrobat DC’s handling of certain images inside PDFs that could allow a malicious PDF to run code on your computer when you open it; typical small businesses should update, but there’s no confirmed active exploitation in the findings.

CVE-2017-11244 is a memory-corruption issue (CWE-119) in Adobe Acrobat Reader/Acrobat DC image conversion when processing EMF data for pixel-block transformations; a specially crafted PDF can trigger the flaw to achieve arbitrary code execution upon user interaction (opening the file).

If you're affected

Malware runs on workstation
Possible data theft risk
Operational disruption via compromise

What is it

Imagine Acrobat like a “picture translator” that turns embedded images in PDFs into something it can display. This flaw is in that translator for a particular image format (EMF). If someone sends you a specially prepared PDF, opening it could let their code run on your computer.

Who is affected

This matters if your business uses Adobe Acrobat Reader, Adobe Acrobat, or Adobe Acrobat DC to open PDF files (especially on Windows endpoints). It’s a risk only when the vulnerable version is installed and a crafted file is opened by a user (user interaction is required).

How urgent is it

This is a GREEN item: it’s a real memory-corruption risk, but the provided findings do not show confirmed active exploitation (it isn’t listed in CISA KEV and no public exploit code was found). Still, because the attacker pathway involves opening a malicious PDF, you should update on your normal patch schedule without delay.

What to do — in detail

Inventory and confirm versions

Identify which machines run: Acrobat Reader, Acrobat, or Acrobat DC.
Record the exact version (as shown inside the app, typically under Help → About).

Determine whether you’re affected

Mark systems as affected if they are:
- 2017.009.20058 and earlier, or
- 2017.008.30051 and earlier, or
- 2015.006.30306 and earlier, or
- 11.0.20 and earlier.

Upgrade to the fixed release

For affected systems, install Adobe’s remediation from APSB17-24.
Reboot if your organization’s update policy requires it, then verify the Acrobat/Reader version is no longer within the affected ranges.

If patching is delayed (temporary risk reduction)

Restrict the ability of users to open untrusted PDFs from email or the internet (process/policy controls).
Treat inbound PDFs from unexpected sources as suspicious and route them through approval before opening.

What to monitor

Look for unusual process launches or crashes of Acrobat immediately after opening PDFs (endpoint monitoring/EDR logs, if you have them).
Watch for alerts triggered around document viewing activity for Acrobat on endpoints.

Note on exploitation status from the provided records:

Not listed in CISA KEV, and no public exploit code is on record in the provided findings.

Technical context

Severity is moderate (CVSS 6.5 in the prompt) and the weakness is CWE-119 (memory corruption). The mechanism involves Adobe Acrobat Reader/Acrobat DC’s image conversion engine processing EMF (Enhanced Metafile Format) data—specifically transformation of blocks of pixels—where memory corruption can occur. The attack requires user interaction (a crafted PDF must be opened), consistent with the described user interaction condition.

Exploitation status (from provided findings):

Not listed in CISA KEV.
No public exploit code on record.
EPSS is described as predicted likelihood with a flat trend, but exploitation confirmation was not provided in the findings.

Patch information (from provided findings):

Adobe remediation is available via APSB17-24.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

25 events over 3330 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → lowepss band change
2026-08-31EPSS band changelow → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

adobecommercial · USaka adobe systems inc.
- acrobat readerDesktop AppOn-premConsumer Software / productivity
- acrobat reader dcDesktop AppOn-premConsumer Software / productivity
- readerConsumer Software
Adobe Systems Incorporatedcommercial · USaka adobe
- Acrobat ReaderWeb & CMS Plugins

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact