PDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature

published 2025-07-15 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21428

cvss: 8.4; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits: 1; Metasploit

A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image using the 'Convert PDF to Image' functionality. An attacker can exploit this vulnerability by tricking a user into opening a maliciously crafted PDF file, leading to arbitrary code execution under the context of the user. This vulnerability has been verified on Windows XP, 7, 8, and 10 platforms using the PDFTools.exe component.

Timeline

2015-10-03 First public exploit (Metasploit exploit/windows/fileformat/shaper_pdf_bof)
2025-07-15 Published

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 15 mo ago (2025-07-15)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/fileformat/shaper_pdf_bof PDF Shaper Buffer Overflow metasploit exploit, normal rank, 2015-10-03
raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/shaper_pdf_bof.rb referenced PoC, tagged "exploit" by a source, unverified
exploit-db.com https://www.exploit-db.com/exploits/37760 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.4	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	8.4	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Burnaware PDF Shaper

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120 Buffer Copy without Checking Size of Input

References

raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/shaper_pdf_bof.rb
exploit
exploit-db.com /exploits/37760
exploit
pdfshaper.com /
product
vulners.com /vulnerlab/VULNERABLE:1579
third-party-advisory
vulncheck.com /advisories/pdf-shaper-buffer-overflow-via-convert-to-image-feature
third-party-advisory

Sources

CVE List CVE-2025-34106
NVD CVE-2025-34106

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary