Vulnerability Spotlight: Multiple vulnerabilities in Nitro Pro PDF reader
Summary: Cisco Talos discovered two code execution vulnerabilities and one information disclosure flaw in Nitro Pro PDF reader version 13.9.1.155, and worked with Nitro PDF under its coordinated disclosure policy to resolve the issues and release an update. The flaws include a use-after-free in the PDF parser, an integer overflow in Pattern object parsing that can lead to arbitrary code execution, and uninitialized memory access in XML error handling, all triggered when a victim opens a malicious file.
Bottom line: Each of these flaws requires only that a user open a crafted PDF, so a single document delivered to a workstation running the unpatched 13.9.1.155 build is enough to hand an attacker code execution or leak memory contents.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-6092CVE-2020-6093
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026