CVE-2021-21798

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
15/09/2021
Last modified:
25/10/2022

Description

An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger the vulnerability.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:gonitro:nitro_pro:13.31.0.605:*:*:*:*:*:*:*
cpe:2.3:a:gonitro:nitro_pro:13.33.2.645:*:*:*:*:*:*:*


References to Advisories, Solutions, and Tools