Read the docs
TI-2019-03510 Aliases CVE-2019-5048GHSA-vp6p-93mp-pf7g

Heap-based buffer overflow in NitroPDF

Priority LOW 38CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.

Why it matters now

EPSS 0.02282 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—NitroPDFNitroPDF 12.12.1.522—No fix listedCNA
  • NitroPDF Vendor— Affected NitroPDF 12.12.1.522 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gonitro:nitropdf:12.2.1.522:*:*:*:*:*:*:*12.2.1.522VulnerableGonitro
  • cpe:2.3:a:gonitro:nitropdf:12.2.1.522:*:*:*:*:*:*:* Versions 12.2.1.522 Vulnerable ·Gonitro

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5048
  2. 2026-10-03 Alias added: GHSA-vp6p-93mp-pf7g

References

Exploit 1

  • TI-2019-03512 Heap-based buffer overflow in NitroPDF CVSS 3.1HIGH 7.8
  • TI-2019-03508 Heap-based buffer overflow in NitroPDF CVSS 3.1HIGH 7.8
  • TI-2019-03507 Heap-based buffer overflow in NitroPDF CVSS 3.1HIGH 7.8
  • TI-2019-03515 Use after free in NitroPDF CVSS 3.1HIGH 7.8
  • TI-2019-03509 Use after free in NitroPDF CVSS 3.1HIGH 7.8
  • TI-2013-02423 Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution CVSS 3.1HIGH 7.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences