Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Iceni Argus PDF Content Extraction affect Mark Logic
Summary: Cisco Talos disclosed seven remote code execution vulnerabilities in Iceni Argus PDF Content Extraction, which affect MarkLogic, each triggered when a user converts a malicious PDF to XML, XHTML, or a polygon. The flaws include stack and heap buffer overflows, an LZW decoder overflow, an arbitrary heap overwrite, and integer overflows, all of which can lead to code execution under the context of the local user.
Bottom line: Each of these seven flaws runs code as the local user the moment a crafted PDF is converted, so the exposure sits in a routine document-processing step rather than in an obvious attack surface. Talos published Snort rules 40917-40926, 40872-40875, and 41327-41328, which means detection depends on those signatures being deployed before a malicious PDF reaches the converter.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-8385CVE-2016-8386CVE-2016-8387CVE-2016-8388CVE-2016-8389CVE-2016-8715CVE-2017-2777
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026