Vulnerability Spotlight: Google PDFium Tiff Code Execution
Summary: Cisco Talos disclosed an off-by-one read/write vulnerability in the TIFF image decoder of PDFium, the PDF renderer used in Google Chrome up to and including version 60.0.3112.101. The flaw, tracked as CVE-2017-5133 and found by Talos's Aleksandar Nikolic, causes a heap-based buffer overflow when the pixel-parsing function reads 4 bytes from 'dest_buffer' even when the buffer is shorter, potentially leading to memory corruption, information leak, or code execution; it was fixed in Chrome 62.0.3202.62.
What you should know: Chrome was the most widely used browser at the time, and a specially crafted PDF was enough to reach the vulnerable decoder - so any user opening the wrong file was the exposure, not just someone visiting a malicious site.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2017-5133
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026