Vulnerability Spotlight: Multiple vulnerabilities in Aspose APIs
Summary: Cisco Talos discovered multiple remote code execution vulnerabilities in Aspose APIs for processing PDFs, Word files and other document formats, including out-of-bounds reads in the LabelSst and Number record parsers of Aspose.Cells 19.1.0 (CVE-2019-5032, CVE-2019-5033) and a stack-based buffer overflow in the EnumMetaInfo function of Aspose.Words 18.11.0.0 (CVE-2019-5041). Talos disclosed the vulnerabilities on Aug. 20, 2019 after unsuccessful attempts to contact Aspose, and Aspose released a fix on Aug. 30, 2019.
What's compelling: Each of these flaws triggers when a victim opens a malformed file, so any service that converts or renders user-supplied documents with Aspose is a delivery path for remote code execution until the Aug. 30, 2019 update is applied.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5032CVE-2019-5033CVE-2019-5034CVE-2019-5041
- Related
- Vulnerability Spotlight: Multiple bugs in Open Weave and Nest Labs Nest Cam IQ indoor camera Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026