CVE-2020-7374

published 2020-08-12

CVE-2020-7374: Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained…

Priority P3 47 high 7.8 CVSS 3.1

AV L AC L PR N UI R S U C H I H A H

EXPLOIT

Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
documalis	free_pdf_editor	—	—
documalis	free_pdf_scanner	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerability is triggered by a malformed JPEG image embedded within a PDF file; inspect PDF files containing JPEG streams for anomalous/oversized JPEG content that could overflow a stack buffer. ↗
• → A Metasploit module exists for this vulnerability targeting Windows fileformat exploitation; monitor for exploit module usage or generated malicious PDF files crafted via this module. ↗
• → Monitor processes spawned by Documalis Free PDF Editor (version 5.7.2.26) or Documalis Free PDF Scanner (version 5.7.2.122) for unexpected child processes, which may indicate successful RCE exploitation. ↗

• · Affected versions are specifically Documalis Free PDF Editor 5.7.2.26 and Documalis Free PDF Scanner 5.7.2.122; detections should be scoped to these exact versions. ↗

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-120