CVE-2017-16415

Think of Adobe Acrobat/Reader like a “document translator.” This bug means a specially crafted PDF can cause Acrobat/Reader to read or write data in the wrong place while processing fonts. If that happens, it can crash the app, steal sensitive data, or—worst case—let malware run on your computer.

This matters if your business computers have Adobe Acrobat or Adobe Acrobat Reader installed and users open PDF files (especially ones received via email, downloads, or document sharing). The risk is higher when an attacker can get a malicious PDF onto a machine where it will be opened.

There is no evidence in the provided findings that this has confirmed been exploited in the wild, but the flaw is serious—so you should act if you’re running one of the affected older versions.

This is a high-severity bug, and older Acrobat/Reader installs are directly in scope for exposure when a user opens a crafted PDF. There’s no publicly recorded exploit code in the findings and it is not listed in CISA KEV, so it’s not confirmed “actively exploited” from this dataset—but you should still upgrade because the impact can be severe.

Verdict: AMBER.

How to confirm exposure

1. On each affected machine, open Adobe Acrobat/Adobe Acrobat Reader.
2. Go to Help → About (or Adobe Acrobat Reader → About Adobe Acrobat Reader) and record the exact version number.
3. Compare it to the affected ranges:
   • 2017.012.20098 and earlier
   • 2017.011.30066 and earlier
   • 2015.006.30355 and earlier
   • 11.0.22 and earlier

Upgrade / patch guidance

• The available findings do not provide a specific “fixed in version” number or patch package. Because of that, the safest action is to upgrade to the latest available Adobe Acrobat/Reader version that your organization can deploy.
• If you use multiple Acrobat-related installs, ensure you update the exact components used for opening PDFs on desktops (not just one management server).

If patching is delayed (temporary mitigations)

• Stop users from opening unexpected PDFs from email attachments, file-sharing links, or the web until updates are installed.
• Train staff to treat unsolicited PDFs as suspicious, even if they look familiar.
• If your environment supports it, reduce exposure by disabling automatic previewing of PDFs in email clients and file browsers, and enforce “open only after scanning.”

What to monitor

• After rollout, verify the version changed on every endpoint that users use to open PDFs.
• Watch endpoint protection logs for alerts related to Acrobat/Reader crashing or suspicious child processes spawned by Acrobat/Reader.

CISA due date

• Not provided in the available findings (CVE-2017-16415 is not listed in CISA KEV).

Severity and weakness

• This vulnerability is classified under CWE-787 (out-of-bounds write), where processing logic can write past the end of an intended buffer.

Attack mechanism (how it’s triggered)

• The issue occurs in Adobe Acrobat/Reader’s font-encoding handling. When a crafted PDF is processed, an internal computation uses an out-of-range pointer offset to access sub-elements of an internal structure, which can corrupt sensitive memory and potentially enable arbitrary code execution.

Exploitation status

• No public exploit code is recorded in the provided findings.
• Not listed in CISA KEV in the provided findings.

Predicted likelihood

• The available findings include an EPSS prediction value, but this is not confirmed exploitation and is not repeated in public-facing blocks.

Fix information

• The available findings include no patch/fixed-version details, so upgrade-to-latest is the actionable path based on the dataset.