CVE-2019-5067 Vulnerability Analysis & Exploit Intelligence

An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can cause a read and write from uninitialized memory, resulting in memory corruption and possibly arbitrary code execution. To trigger this vulnerability, a specifically crafted PDF document needs to be processed by the target application.

Published Sep 18, 2019Updated Aug 4, 2024Sources: cvelistV5, talos

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

chance of exploitation in 30 days

Affects

talos

aspose

CVSS base

9.8

CRITICAL

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (1)

talos

Products (1)

aspose

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Source
9.8	CVSS 3.0	CRITICAL	—	—	cvelistV5

Weakness & attack patterns

CWE-416

References

1 on the record

www.talosintelligence.com/vulnerability_reports/TALOS-2019-0856
x_refsource_CONFIRM

Elsewhere on this site

talosevery CVE for this vendor
CWE-416other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.