Vulnerability · Published Oct 18, 2021 · Assigned by talos

CVE-2021-21796

High 8.8

In plain English

A high-severity use-after-free in Nitro Pro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.8% (higher than 97% of all known vulnerabilities).

Severity (CVSS 3.0)8.8High

Exploit odds (30 days)15.8%top 3.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Nitro Pro	Nitro Pro 13.31.0.605,Nitro Pro 13.33.2.645

Weakness: CWE-416 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1265 x_refsource_MISC