Netskope Threat Labs

FILE-PDF Acrobat Reader PDFDocEncoding object WinAnsiEncoding memory corruption attempt

IPS-SWG

1 SID: 43877

First seen
October 2022
Last seen
October 2026

Detects a PDF exploiting CVE-2017-11263, memory corruption in Adobe Acrobat Reader's text encoding conversion that can allow code execution. The rule matches the conflicting encoding declarations that public exploits use to corrupt parser memory.