Security readout for executives and security teams
Plain-English summary
This CVE affects STDU Viewer 1.6.375 when handling a crafted .jb2 file. The reported outcome is application denial of service, with unspecified other impact possible. The source bundle does not provide CVSS, CWE, patch details, or evidence of active exploitation.
Executive priority
Moderate operational attention is reasonable if STDU Viewer is present, especially on workstations handling external files. Without exploitation evidence, CVSS, or patch data, this is not a board-level emergency, but unsupported document viewers should be cleaned up quickly.
Technical view
The issue is a read access violation in STDUJBIG2File during processing of a crafted JBIG2 .jb2 file. Public details identify STDU Viewer 1.6.375 and describe denial of service or possibly unspecified impact, but do not establish reliable code execution, affected platforms, or fixed versions.
Likely exposure
Exposure is most likely on user workstations where STDU Viewer 1.6.375 is installed and used to open untrusted .jb2 files. Enterprise exposure depends on software inventory, file association, and whether JBIG2 files are received through email, web downloads, or document workflows.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. The known trigger is a crafted .jb2 file opened by the affected viewer. Treat exploitation status as unconfirmed and avoid assuming broader impact beyond the published description.
Researcher notes
Evidence is thin: one CVE description and one public advisory reference. The report indicates a memory read access violation during crafted .jb2 parsing. Do not infer remote code execution or active exploitation from the provided data.
Mitigation direction
- Inventory endpoints for STDU Viewer 1.6.375 installations.
- Check vendor or trusted advisory sources for update or replacement guidance.
- Reduce handling of untrusted .jb2 files until guidance is confirmed.
- Quarantine unexpected .jb2 attachments where there is no business need.
- Consider replacing unsupported viewer software in managed environments.
Validation and detection
- Confirm whether STDU Viewer 1.6.375 exists in endpoint software inventory.
- Check whether .jb2 files are associated with STDU Viewer.
- Review crash telemetry for STDUJBIG2File read access violations.
- Assess email and download paths for incoming .jb2 files.
- Record that no KEV evidence is present in the provided bundle.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14309 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14309CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.