Security readout for executives and security teams
Plain-English summary
This CVE concerns STDU Viewer 1.6.375 crashing, and possibly suffering other unspecified impact, when handling a crafted .jb2 file. The sources do not provide a CVSS score, confirmed code execution, patch status, or active exploitation evidence. Treat it as a file-parsing risk where users may open untrusted JBIG2 files.
Executive priority
Handle as a targeted hygiene item, not an emergency, unless STDU Viewer 1.6.375 is widely deployed or used to review untrusted files. The business concern is user-driven file parsing leading to crashes and possibly unspecified impact, with incomplete public severity data.
Technical view
The CVE describes a crafted .jb2 file causing denial of service or unspecified impact in STDU Viewer 1.6.375. The reported crash detail says data from the faulting address controls branch selection in STDUJBIG2File. No CWE, CVSS vector, vendor advisory, fixed version, or reproducible technical detail is included in the provided sources.
Likely exposure
Exposure appears limited to environments where STDU Viewer 1.6.375 is installed and users can open untrusted .jb2 files. The CVE affected-product metadata is incomplete, so broader version or product impact cannot be confirmed from the supplied sources.
Exploitation context
The source bundle does not show CISA KEV listing or any cited active exploitation evidence. The described trigger is a crafted JBIG2 file opened by the vulnerable viewer, but the sources do not confirm practical exploitation beyond denial of service or unspecified impact.
Researcher notes
The public record is sparse. Key unknowns include affected versions beyond 1.6.375, exploitability beyond denial of service, root cause, patch status, and vendor ownership. Avoid asserting code execution or active exploitation without additional evidence.
Mitigation direction
- Inventory and remove STDU Viewer 1.6.375 where it is not business-required.
- Check vendor or maintainer guidance for updates or replacement recommendations.
- Block or quarantine untrusted .jb2 attachments and downloads where feasible.
- Use safer document viewers for untrusted files.
- Limit vulnerable viewer use to trusted files and isolated workstations.
Validation and detection
- Search endpoint inventory for STDU Viewer 1.6.375 installations.
- Review file-association policies for .jb2 and JBIG2 content.
- Check email and web controls for .jb2 filtering coverage.
- Review crash telemetry for STDUJBIG2File-related faults.
- Confirm whether any vendor-fixed version is available before closure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14305 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14305CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.