CVE-2021-40160

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

PDFTron prior to 9.0.7 version may be forced to read beyond allocated boundaries when parsing a maliciously crafted PDF file. This vulnerability can be exploited to execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Dec 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-401617.8A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 versio CVE-2021-401627.8A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries CVE-2021-401637.8A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing compone CVE-2021-401647.8A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitra CVE-2021-401657.8A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer w CVE-2021-401667.8A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed w CVE-2021-401677.8A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by rea CVE-2021-40178.8showdoc is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-401706.8An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an CVE-2021-401715.3The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-IT CVE-2021-401728.8Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.CVE-2021-401738.8Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.