Vulnerability Spotlight: Multiple vulnerabilities in Nitro Pro PDF reader
Summary: Cisco Talos discovered multiple code execution vulnerabilities in Nitro Pro PDF reader versions 13.13.2.242 and 13.16.2.300, including an indexed ColorSpace buffer miscalculation (CVE-2020-6116), an ICCBased ColorSpace heap-based buffer overflow (CVE-2020-6146), a JPEG2000 stripe sub-sample out-of-bounds write (CVE-2020-6112), an object stream parsing integer overflow (CVE-2020-6113), and a cross-reference table use-after-free (CVE-2020-6115). Each flaw requires a victim to load a specially crafted document, and Talos worked with Nitro Pro under its coordinated disclosure policy to resolve the issues and release an update.
Key Takeaway: Five separate memory-corruption paths in a single PDF reader mean a single malicious document can hand an adversary code execution on the victim's machine, and Talos confirmed both 13.13.2.242 and 13.16.2.300 are affected.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-6112CVE-2020-6113CVE-2020-6115CVE-2020-6116CVE-2020-6146
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026