CVE-2020-10223: gonitro nitro_pro Out-of-bounds Write
CVSS: 8.1v3.1HighModified
Published 08-03-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-10223 is a high (CVSS 8.1) Out-of-bounds Write vulnerability in gonitro nitro_pro. EPSS estimates a 2.49% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
2.49%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, reference
Timeline
- 08-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to JBIG2Decode CNxJBIG2DecodeStream Heap Corruption at npdf!CAPPDAnnotHandlerUtils::create_popup_for_markup+0x12fbe via a crafted PDF document.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HSourcesSingle source
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.49%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.49% on 19-09-2026
19-09-202619-10-2026
EPSS score2.49%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundNafiez.Github.Io
Maturity: poc
Exploit Reference (nafiez.github.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Gonitro1 product
- nitro_pro< 13.13.2.242
1 vendor · 1 product