Skip to content
Fencer Vulns
high 8.8

CVE-2020-6113 in the critical feed json

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updatin…

published 2020-09-17 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-27267

cvss
8.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
64.1%
EPSS 64.1% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known

Summary

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability.

Exploit prediction

64.14% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2020-1063 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • n/a Nitro Pro

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
  • CWE-131 Incorrect Calculation of Buffer Size
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.