Vulnerability Spotlight: Code execution vulnerability in Nitro Pro PDF
Summary: Cisco Talos discovered a use-after-free vulnerability, TALOS-2021-1267 (CVE-2021-21798), in the Nitro Pro PDF reader that can be triggered when a target opens a specially crafted, malicious PDF, allowing code execution in the context of the application. Talos confirmed Nitro Pro versions 13.31.0.605 and 13.33.2.645 could be exploited, worked with Nitro on an update, and noted the flaw can also be mitigated by disabling JavaScript in the software's settings.
What's compelling: The exploit path is a document your users open every day, and Talos confirmed two specific Nitro Pro builds were exploitable - so the exposure lasts until those installs are patched or JavaScript is turned off.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21798
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026