High severity · published Oct 9, 2019
CVE-2019-5045
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522
7.8
CVSS
2.3%
EPSS
No
On KEV
Description
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NI
Nitropdf · Gonitro
12.12.1.522 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5045
Exploit
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0814
More from Nitropdf
7.8
CVE-2013-2773
Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution
7.8
CVE-2019-5053
An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF
7.8
CVE-2019-5050
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522
7.8
CVE-2019-5048
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522
7.8
CVE-2019-5047
An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF