Vulnerability · Published Aug 5, 2021 · Assigned by krcert
CVE-2021-26605unidocs ezPDFReader arbitrary command execution vulnerability
High 7.5
In plain English
A high-severity improper input validation in ezPDFReader from unidocs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 35.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred when the ezPDF launcher received and executed crafted input values through JSON-RPC communication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| unidocs | ezPDFReader | 2.0 ~ 3.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N