CVE-2016-8388

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An exploitable arbitrary heap-overwrite vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will explicitly trust an index within the specific font object and use it to write the font's name to a single object within an array of objects.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
IceniArgus6.6.04 (Sep 7 2012) NK

References

Timeline

Published
Feb 28, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-83897.8An exploitable integer-overflow vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will attemptCVE-2016-83907.8An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially crCVE-2016-83917.0An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wiCVE-2016-83927.0An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wiCVE-2016-83937.0An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary CVE-2016-83947.0An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary CVE-2016-83954.7A denial of service vulnerability in the NVIDIA camera driver could enable an attacker to cause a local permanent denial of service, which mCVE-2016-83965.5An information disclosure vulnerability in the MediaTek video driver could enable a local malicious application to access data outside of itCVE-2016-83975.5An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its CVE-2016-83989.8Unauthenticated messages processed by the UE. Certain NAS messages are processed when no EPS security context exists in the UE. Product: AndCVE-2016-83997.0An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary cCVE-2016-84005.5An information disclosure vulnerability in the NVIDIA librm library (libnvrm) could enable a local malicious application to access data outs
CVE-2016-8388: High severity, CVSS 7.8 | Vulnix