Description
An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can cause a read and write from uninitialized memory, resulting in memory corruption and possibly arbitrary code execution. To trigger this vulnerability, a specifically crafted PDF document needs to be processed by the target application.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0856
Scores
CVSS v3
9.8
EPSS
0.0341
EPSS Percentile
87.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
CWE-908
Status
published
Products (1)
aspose/aspose.pdf_for_c\+\+
19.2
Published
Sep 18, 2019
Tracked Since
Feb 18, 2026