CVE-2021-21798

high · 7.8

An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger the vulnerability.

7.8

CVSS

16.0%

EPSS (exploit prob.)

97th

EPSS percentile

2021-09-15

Published

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-562

Affected products

Vendor	Product	Affected versions
gonitro	nitro_pro	13.31.0.605
gonitro	nitro_pro	13.33.2.645

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1267
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1267

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-21798