CVE-2018-18689: avanquest expert_pdf_ultimate
Vulnerability summary
CVE-2018-18689 is a medium (CVSS 5.3) vulnerability in avanquest expert_pdf_ultimate. EPSS estimates a 3.63% chance of exploitation in the next 30 days, higher than 89.4% of scored vulnerabilities.
Timeline
- 07-01-2021PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.63%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
-0.06 pp
From 3.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Avanquest2 products
- expert_pdf_ultimate12.0.20
- pdf_experte_ultimate9.0.270
Gonitro2 products
- nitro_pro11.0.3.173
- nitro_reader5.5.9.2
Iskysoft2 products
- pdf_editor_66.4.2.3521 | 6.6.2.3315 | 6.7.6.3399
- pdfelement66.8.0.3523 | 6.8.4.3921 | 6.7.1.3355 | 6.7.6.3399
Qoppa2 products
- pdf_studio12.0.7
- pdf_studio_viewer_20182018.0.1 | 2018.2.0
Sodapdf2 products
- soda_pdf9.3.17
- soda_pdf_desktop10.2.09 | 10.2.16.1217
Soft-xpansion2 products
- perfect_pdf_1010.0.0.1
- perfect_pdf_reader13.0.3 | 13.1.5
Foxitsoftware1 product
- foxit_reader9.1.0 | 9.2.0.9297 | 9.3.0.10826 | 9.2.0
Pdf-xchange1 product
- pdf-xchange_editor7.0.237.1 | 7.0.326
Pdfforge1 product
- pdf_architect6.0.37 | 6.1.24.1862
Tracker-software1 product
Visagesoft1 product
- expert_pdf_reader9.0.180
11 vendors · 17 products
References
4 links- www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/X Refsource MISCThird Party Advisory