Read the docs
TI-2008-07005 Aliases CVE-2008-20001GHSA-3qqp-q5fr-m8m7

activePDF WebGrabber ActiveX Control Buffer Overflow

Priority HIGH 68CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus() method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the context of the vulnerable process. Although the control is not marked safe for scripting, exploitation is possible via crafted HTML content in Internet Explorer under permissive security settings.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01585 75th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
activePDFWebGrabberup to 3.8.2.0—No fix listedCNA
  • WebGrabber VendoractivePDF Affected up to 3.8.2.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-20001
  2. 2026-10-03 Alias added: GHSA-3qqp-q5fr-m8m7

References

Exploit 2

Other 3

  • TI-2007-05648 Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer… CVSS 2.0HIGH 9.3
  • TI-2018-05268 The Pictview image processing library embedded in the ActivePDF toolkit through… CVSS 3.0CRITICAL 9.8
  • TI-2007-05649 Stack-based buffer overflow in Autonomy (formerly Verity) KeyView Viewer, Filter, and… CVSS 2.0HIGH 9.3
  • TI-2007-05758 Multiple stack-based buffer overflows in foliosr.dll in the Folio Flat File speed reader… CVSS 2.0HIGH 9.3
  • TI-2007-05192 Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents… CVSS 2.0HIGH 9.3
  • TI-2007-05184 Heap-based buffer overflow in the activePDF Server service (aka APServer.exe) in… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences