Vulnerability Spotlight: Remote code execution vulnerability in Antenna House Rainbow PDF Office Server Document Converter
Summary: Cisco Talos's Emmanuel Tacheau discovered a heap overflow vulnerability in Antenna House Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7,0,2018,1113), in the function that converts PowerPoint files to PDF. The getSummaryInformation function incorrectly checks the correlation between size and the number of properties in PropertySet packets while parsing the Document Summary Property Set stream, causing an out-of-bounds write that leads to heap corruption and code execution; Talos confirmed version 7.0 Pro R1 for Linux64 is impacted and published Snort rules 49209 and 49210 to detect exploitation attempts.
Key Takeaway: A document converter that turns Office files into PDFs sits directly in the path of untrusted input, so a heap overflow there hands an attacker remote code execution on the machine doing the converting.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5019
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026