Vulnerability Spotlight: Multiple remote code execution bugs in NitroPDF

Summary: Cisco Talos disclosed multiple remote code execution vulnerabilities in the Pro version of NitroPDF, all affecting version 12.12.1.522, without a patch from NitroPDF after its 90-day disclosure deadline expired. The bugs include heap corruption triggered by crafted jpeg2000 files embedded in PDFs and by crafted PDFs exploiting the Page Kids, ICCBased color space, and jpeg2000 yTsiz parsing paths, plus use-after-free conditions in the CharProcs and Length parsing functions, each requiring the victim to open a malicious file.
Why it matters: These flaws are disclosed with no vendor patch, so every user of NitroPDF Pro 12.12.1.522 who opens a crafted PDF is exposed to arbitrary code execution until NitroPDF responds.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-5046 CVE-2019-5047 CVE-2019-5048 CVE-2019-5050 CVE-2019-5053
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026