Log in Start free

Vulnerability · Published Oct 18, 2021 · Assigned by talos

CVE-2021-21797

High 8.8

In plain English

A high-severity double free in Nitro Pro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.0% (higher than 97% of all known vulnerabilities).

Severity (CVSS 3.0)8.8High
Exploit odds (30 days)15.0%top 3.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.

Affected products (as reported)

VendorProductVersions
n/a Nitro Pro Nitro Pro 13.31.0.605 ,Nitro Pro 13.33.2.645

Weakness: CWE-415 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References