CVE-2021-21796CWE-416

An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF

High · published October 18, 2021

CVSS v3.0
8.8
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15777 · 96.9th percentile
Weakness
CWE-416 · Use After Free
Published
2021-10-18T12:42Z
EPSS history
Timeline
  • 18 OCT 12:42Z
    An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF
    cvelistv5