Read the docs
TI-2026-11447 Aliases CVE-2026-13522GHSA-3pg9-gwgr-fmmw

Investintech SlimPDFReader PDF File SlimPDFReader.exe TeighaDo+0x25cde0 out-of-bounds

Priority MEDIUM 57CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security flaw has been discovered in Investintech SlimPDFReader up to 2.0.14. Affected by this issue is the function SlimPDFReader!Investintech::PCV::TeighaDo+0x25cde0 of the file SlimPDFReader.exe of the component PDF File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
InvestintechSlimPDFReader2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; 2.0.7; 2.0.8; 2.0.9; 2.0.10; 2.0.11; 2.0.12; 2.0.13; 2.0.14—No fix listedCNA
  • SlimPDFReader VendorInvestintech Affected 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; 2.0.7; 2.0.8; 2.0.9; 2.0.10; 2.0.11; 2.0.12; 2.0.13; 2.0.14 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:investintech:slimpdfreader:*:*:*:*:*:*:*:*——Investintech
  • cpe:2.3:a:investintech:slimpdfreader:*:*:*:*:*:*:*:* Versions — — ·Investintech

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13522
  2. 2026-10-03 Alias added: GHSA-3pg9-gwgr-fmmw

References

—

  • TI-2026-07675 Investintech SlimPDFReader SlimPDFReader.exe sub_3B4610 stack-based overflow CVSS 4.0MEDIUM 5.3
  • TI-2011-03712 Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows… CVSS 2.0HIGH 9.3
  • TI-2011-03711 Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows… CVSS 2.0HIGH 9.3
  • TI-2011-03710 Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified… CVSS 2.0HIGH 9.3
  • TI-2011-03713 Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers… CVSS 2.0HIGH 9.3
  • TI-2011-03709 Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting… CVSS 2.0HIGH 9.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences