What is CVE-2017-16410?

CVE-2017-16410 is a high-severity vulnerability in Adobe Acrobat, classified under Improper Validation of Array Index. CVSS score: 8.8/10. Published 2017-12-09.

How severe is CVE-2017-16410?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Adobe Acrobat

CVE-2017-16410

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is a result of untrusted input that is used to calculate an array index; the calculation occurs in the image conversion module, when processing GIF files. The vulnerability leads to an operation that can write to a memory location that is outside of the memory addresses allocated for the data structure. The specific scenario leads to a write access to a memory location that does not belong to the relevant process address space.

Published 2017-12-09 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.085 (94.9th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.085 · newest: 0.085 · change: 0.000

Affected products

Adobe Acrobat
Adobe Acrobat Dc
Adobe Acrobat Reader
Adobe Acrobat Reader Dc
Adobe Acrobat Reader 2017.012.20098 And Earlier Versions, 2017.011.30066 2015.006.30355 11.0.22 Versions — versions Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions

Weakness classification (CWE)

CWE-129 — Improper Validation of Array Index

References

www.securitytracker.com/id/1039791 (VDB Entry, Third Party Advisory, vdb-entry)
www.securityfocus.com/bid/101819 (VDB Entry, Third Party Advisory, vdb-entry)
helpx.adobe.com/security/products/acrobat/apsb17-36.html (Broken Link)

Frequently asked questions

What is CVE-2017-16410?: CVE-2017-16410 is a high-severity vulnerability in Adobe Acrobat, classified under Improper Validation of Array Index. CVSS score: 8.8/10. Published 2017-12-09.
How severe is CVE-2017-16410?: High severity. CVSS v3 base score is 8.8 out of 10.