Vulnerability Spotlight: Multiple vulnerabilities in Accusoft Image Gear

Summary: Cisco Talos discovered multiple vulnerabilities in Accusoft ImageGear, a document-imaging toolkit supporting more than 100 file formats, including out-of-bounds write flaws tracked as TALOS-2021-1257 (CVE-2021-21793), TALOS-2021-1261 (CVE-2021-21794) and TALOS-2021-1289 (CVE-2021-21824), plus buffer overflows and an improper array index validation issue in TALOS-2021-1296 (CVE-2021-21833). An attacker could trigger them by tricking a user into opening a specially crafted malicious file, leading to memory corruption and remote code execution, and Talos confirmed versions 19.8 and 19.9 of ImageGear could be exploited.
What's compelling: The entry point is a user opening one crafted file in a library that handles DICOM, PDF and Office formats, and exploitation can end in remote code execution on the victim machine. Talos tested and confirmed versions 19.8 and 19.9 are exploitable, so any deployment still on those builds carries the full chain from file open to code execution.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-21793 CVE-2021-21794 CVE-2021-21795 CVE-2021-21807 CVE-2021-21808 CVE-2021-21821 CVE-2021-21824 CVE-2021-21833
Related: Threat Source newsletter (June 3, 2021) Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026