CVE-2020-7374
Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 3.09% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- documalis/free pdf editor · documalis/free pdf scanner
- Source
- cve@rapid7.com
References
- https://github.com/rapid7/metasploit-framework/pull/13517Exploit, Issue Tracking, Patch, Third Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/13517Exploit, Issue Tracking, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.