CVE-2021-21796

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	Nitro Pro	Nitro Pro 13.31.0.605,Nitro Pro 13.33.2.645

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1265Exploit, Mitigation, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1265Exploit, Mitigation, Third Party Advisory

Timeline

Published: Oct 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217977.8An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a CVE-2021-217987.8An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted CVE-2021-217996.1Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a use CVE-2021-21804.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and CVE-2021-218006.1Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user v CVE-2021-218016.1This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craft CVE-2021-218026.1This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craft CVE-2021-218036.1This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craft CVE-2021-218049.8A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A spe CVE-2021-218059.8An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially c CVE-2021-218068.8An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML web page can cause a us CVE-2021-218079.8An integer overflow vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.9. A specially crafted ma