CVE-2021-21796

high · 7.8

An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.

7.8

CVSS

15.8%

EPSS (exploit prob.)

97th

EPSS percentile

2021-10-18

Published

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-416

Affected products

Vendor	Product	Affected versions
gonitro	nitro_pro	13.31.0.605
gonitro	nitro_pro	13.33.2.645

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1265
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1265

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-21796