PT-2019-17432 · Nitro · Nitropdf

Aleksandar Nikolic · Published 2019-10-09 · Updated 2022-06-27 · CVE-2019-5046

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NitroPDF version 12.12.1.522

Description A specially crafted jpeg2000 file embedded in a PDF can cause heap corruption when opened in the affected software, potentially leading to arbitrary code execution if the memory is carefully manipulated. The victim must open the malicious file to trigger this issue.

Recommendations For NitroPDF version 12.12.1.522, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2019-5046

Affected Products

Nitropdf

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0815 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5046 · Security Note