TI-2026-07675 Aliases CVE-2026-8733 GHSA-j7p9-2c5r-5rg7

Investintech SlimPDFReader SlimPDFReader.exe sub_3B4610 stack-based overflow

MEDIUM 57CWE-119Published 2026-05-17 · Updated 2026-05-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor responded to the initial vulnerability report by the researcher with a note that the product is discontinued. This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00261 17th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Investintech	SlimPDFReader	2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; 2.0.7; 2.0.8; 2.0.9; 2.0.10; 2.0.11; 2.0.12; 2.0.13	—	No fix listed	CNA

SlimPDFReader VendorInvestintech Affected 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; 2.0.7; 2.0.8; 2.0.9; 2.0.10; 2.0.11; 2.0.12; 2.0.13 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:investintech:slimpdfreader::::::::	—	—	Investintech

cpe:2.3:a:investintech:slimpdfreader:*:*:*:*:*:*:*:* Versions — — ·Investintech

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-8733
2026-10-03 Alias added: GHSA-j7p9-2c5r-5rg7

References

Exploit 1

https://sharing.sit.fraunhofer.de/s/RYcqZbGqgZXxab2

TI-2026-11447 Investintech SlimPDFReader PDF File SlimPDFReader.exe TeighaDo+0x25cde0 out-of-bounds CVSS 4.0MEDIUM 5.3
TI-2011-03712 Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows… CVSS 2.0HIGH 9.3
TI-2011-03711 Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows… CVSS 2.0HIGH 9.3
TI-2011-03710 Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified… CVSS 2.0HIGH 9.3
TI-2011-03713 Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers… CVSS 2.0HIGH 9.3
TI-2011-03709 Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting… CVSS 2.0HIGH 9.3

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences