CVE-2016-8386

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a PDF containing a malformed font to XML, the tool will attempt to use a size out of the font to search through a linked list of buffers to return. Due to a signedness issue, a buffer smaller than the requested size will be returned. Later when the tool tries to populate this buffer, the overflow will occur which can lead to code execution under the context of the user running the tool.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-83877.8An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multi CVE-2016-83887.8An exploitable arbitrary heap-overwrite vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will CVE-2016-83897.8An exploitable integer-overflow vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will attempt CVE-2016-83907.8An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially cr CVE-2016-83917.0An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi CVE-2016-83927.0An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi CVE-2016-83937.0An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary CVE-2016-83947.0An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary CVE-2016-83954.7A denial of service vulnerability in the NVIDIA camera driver could enable an attacker to cause a local permanent denial of service, which m CVE-2016-83965.5An information disclosure vulnerability in the MediaTek video driver could enable a local malicious application to access data outside of it CVE-2016-83975.5An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its CVE-2016-83989.8Unauthenticated messages processed by the UE. Certain NAS messages are processed when no EPS security context exists in the UE. Product: And