What is CVE-2017-16385?

CVE-2017-16385 is a high-severity vulnerability in Adobe Acrobat, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2017-12-09.

How severe is CVE-2017-16385?

High severity. CVSS v3 base score is 8.8 out of 10.

Buffer overflow in Adobe Acrobat

CVE-2017-16385

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer access with an incorrect length value in TIFF parsing during XPS conversion. Crafted TIFF image input causes a mismatch between allocated buffer size and the access allowed by the computation. If an attacker can adequately control the accessible memory then this vulnerability can be leveraged to achieve arbitrary code execution.

Vulnerability class: Buffer Overflow

Published 2017-12-09 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.128 (96.2th percentile), scored 2026-10-03.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.128 · newest: 0.128 · change: 0.000

Affected products

Adobe Acrobat
Adobe Acrobat Dc
Adobe Acrobat Reader
Adobe Acrobat Reader Dc
Adobe Acrobat Reader 2017.012.20098 And Earlier Versions, 2017.011.30066 2015.006.30355 11.0.22 Versions — versions Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

www.securitytracker.com/id/1039791 (VDB Entry, Third Party Advisory, vdb-entry)
helpx.adobe.com/security/products/acrobat/apsb17-36.html (Vendor Advisory)
www.securityfocus.com/bid/101831 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2017-16385?: CVE-2017-16385 is a high-severity vulnerability in Adobe Acrobat, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2017-12-09.
How severe is CVE-2017-16385?: High severity. CVSS v3 base score is 8.8 out of 10.