CVE-2020-6113

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability.

• CWE-190
• CWE-131
• CWE-190
• CWE-787

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1063Exploit, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1063Exploit, Third Party Advisory

Published

Sep 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6107An exploitable information disclosure vulnerability exists i…5.5
• CVE-2020-6108An exploitable code execution vulnerability exists in the fs…7.8
• CVE-2020-6109An exploitable path traversal vulnerability exists in the Zo…9.8
• CVE-2020-6110An exploitable partial path traversal vulnerability exists i…8.8
• CVE-2020-6111An exploitable denial-of-service vulnerability exists in the…7.5
• CVE-2020-6112An exploitable code execution vulnerability exists in the JP…7.8
• CVE-2020-6114An exploitable SQL injection vulnerability exists in the Adm…7.2
• CVE-2020-6115An exploitable vulnerability exists in the cross-reference t…7.8
• CVE-2020-6116An arbitrary code execution vulnerability exists in the rend…7.8
• CVE-2020-6117SQL injection vulnerabilities exist in the CheckDuplicateStu…8.8
• CVE-2020-6118SQL injection vulnerabilities exist in the CheckDuplicateStu…8.8
• CVE-2020-6119SQL injection vulnerabilities exist in the CheckDuplicateStu…8.8