A victim must open a malicious file to trigger this vulnerability” continues the advisory.

A specially crafted PDF file can trigger an integer overflow that can lead to arbitrary code execution. “An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects. The second vulnerability, tracked as CVE-2020-6092, is an object code execution vulnerability that resides in the way Nitro Pro 13.9.1.155 parses Pattern objects. An attacker could exploit the flaw by tricking the victims into opening a specially crafted PDF and trigger an integer overflow and then achieve remote code execution. An attacker can provide a malicious file to trigger this vulnerability.” reads the advisory published by the company. A specially crafted PDF document can cause a use-after-free which can lead to remote code execution. “An exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155. An attacker could exploit the vulnerability by tricking the victims into opening a specially crafted PDF to trigger a use-after-free condition. The first issue, tracked as CVE-2020-6074, is a nested pages remote code execution vulnerability that resides the PDF parser of Nitro Pro.

Nitro pdf creator 8