Vulnerability Spotlight: Buffer overflow vulnerabilities in Accusoft Image Gear could lead to code execution
Summary: Cisco Talos discovered multiple heap-based buffer overflow vulnerabilities in Accusoft ImageGear, a document-imaging toolkit supporting more than 100 file formats including DICOM, PDF and Microsoft Office. All but one of the vulnerabilities, TALOS-2021-1374, could lead to code execution, and a separate issue, TALOS-2021-1377 (CVE-2021-21949), could also lead to code execution if an attacker triggers a use-after-free condition.
Bottom line: Talos disclosed the flaws in February 2022 with no known updates or patches from Accusoft, and the fix did not arrive until May 2, 2022 - roughly three months in which anyone running ImageGear 19.10, the version Talos confirmed as affected, had no vendor remedy.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21949
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026