Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF
Summary: Cisco Talos discovered multiple vulnerabilities in the Nitro Pro PDF reader that could let an attacker execute code in the context of the application when a target opens a specially crafted, malicious PDF. TALOS-2021-1265 (CVE-2021-21796) is a use-after-free flaw and TALOS-2021-1266 (CVE-2021-21797) is a double-free flaw that can store a reference to a timeout object in two places, leading to code execution; Nitro has since released fixes for Nitro Pro versions 13.31.0.605 and 13.33.2.645.
What you should know: Talos tested and confirmed those two Nitro Pro versions could be exploited, and the flaws trigger when a user simply opens a malicious PDF - so the exposure sits with anyone running the unpatched reader, not with a misconfigured server.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21796CVE-2021-21797
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026