Deep Dive in Mark Logic Exploitation Process via Argus PDF Converter
Summary: Cisco Talos published a technical deep dive on exploiting the Argus PDF converter in MarkLogic, which the product invokes whenever the XDMP API "pdf-convert" is called, spawning a "convert" binary that uses Argus.dll to turn PDFs into XHTML. Talos used CVE-2016-8335, a stack-based buffer overflow in the Iceni Argus ipNameAdd function, to demonstrate remote code execution on MarkLogic 8.0-5.5 on Windows, where the convert component runs with SYSTEM privileges and the executable lacks DEP and ASLR.
What you should know: On Windows, MarkLogic spawns the convert component without dropping privileges, so a malicious PDF fed to pdf-convert yields SYSTEM-level access automatically, and the absence of DEP and ASLR in the executable reduces the exploit to a direct jmp esp path.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-8335
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026