Vulnerability Spotlight: Two remote code execution vulnerabilities in Investintech Able2Extract
Summary: Cisco Talos discovered two remote code execution vulnerabilities in Investintech's Able2Extract Professional, a cross-platform PDF tool for Windows, Mac and Linux. A specially crafted JPEG file (TALOS-2019-0880/CVE-2019-5088) or BMP file can cause an out-of-bounds memory write, allowing an attacker to execute arbitrary code on the victim machine.
What you should know: Both flaws are triggered by a file the user simply opens, so a single malicious JPEG or BMP delivered to anyone running Able2Extract Professional is enough to hand an attacker code execution on that machine.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5088
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026