CVE-2021-21797

An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

15.05% chance of exploitation in the next 30 days, 96th percentile

Published

2021-10-18

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1266

References

• CVE Record
• NVD entry

Related

• CVE-2021-21796
• CVE-2021-21798
• CVE-2021-21795
• CVE-2021-21799
• CVE-2021-21793
• CVE-2021-21800