VYPR
← All advisories
High severity7.8NVD Advisory· Published Sep 17, 2020· Updated Jun 17, 2026

CVE-2020-6112

CVE-2020-6112

Description

An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which allow for the decoder to write out of-bounds and cause memory corruption. This can result in code execution. A specially crafted image can be embedded inside a PDF and loaded by a victim in order to trigger this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Gonitro/Nitro PDF Pro2 versions
    cpe:2.3:a:gonitro:nitro_pro:13.13.2.242:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:gonitro:nitro_pro:13.13.2.242:*:*:*:*:*:*:*
    • cpe:2.3:a:gonitro:nitro_pro:13.16.2.300:*:*:*:*:*:*:*
  • Nitro Software, Inc./Nitro Prodescription
  • Nitro Software, Inc./Nitro Prollm-create
    Range: 13.13.2.242

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.