Vulnerability Spotlight: TALOS-2017-0393 / CVE-2017-2886 - ACDSee Ultimate 10 Remote Code Execution Vulnerability

Summary: Cisco Talos reported a memory corruption vulnerability, CVE-2017-2886, in the .PSD parsing functionality of ACD Systems International Inc.'s ACDSee Ultimate 10. A byte value taken directly from a crafted .PSD file is used as a size argument to the C++ memmove function, letting an attacker overwrite large parts of memory to crash the application or potentially execute arbitrary code by overwriting critical control flow structures.
What's compelling: The flaw turns a routine act - opening a PSD file - into a possible path to arbitrary code execution, and Talos notes its Snort rules 43862-43863 may change as more vulnerability information emerges, so detection coverage is not fixed.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2017-2886
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026