CVE-2021-21797: Double Free
An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21797?
CVE-2021-21797 is a double-free vulnerability in the JavaScript implementation of Nitro Pro PDF.
How does CVE-2021-21797 work?
A specially crafted document can cause a reference to a timeout object to be stored in two different places, leading to the reference being released twice when the document is closed.
What is the severity of CVE-2021-21797?
CVE-2021-21797 has a severity rating of 7.8 (high).
Which software versions are affected by CVE-2021-21797?
Versions 13.31.0.605 and 13.33.2.645 of Gonitro Nitro Pro are affected by CVE-2021-21797.
Is there a fix available for CVE-2021-21797?
The vendor has released a fix for CVE-2021-21797. It is recommended to update to a patched version of Gonitro Nitro Pro.