CVE-2021-21797

An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.

• CWE-415
• CWE-415

• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1266Exploit, Mitigation, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1266Exploit, Mitigation, Third Party Advisory

Published

Oct 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21791An information disclosure vulnerability exists in the the wa…5.5
• CVE-2021-21792An information disclosure vulnerability exists in the the wa…5.5
• CVE-2021-21793An out-of-bounds write vulnerability exists in the JPG sof_n…8.8
• CVE-2021-21794An out-of-bounds write vulnerability exists in the TIF bits_…7.8
• CVE-2021-21795A heap-based buffer overflow vulnerability exists in the PSD…9.8
• CVE-2021-21796An exploitable use-after-free vulnerability exists in the Ja…7.8
• CVE-2021-21798An exploitable return of stack variable address vulnerabilit…7.8
• CVE-2021-21799Cross-site scripting vulnerabilities exist in the telnet_for…6.1
• CVE-2021-2180Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-21800Cross-site scripting vulnerabilities exist in the ssh_form.p…6.1
• CVE-2021-21801This vulnerability is present in device_graph_page.php scrip…6.1
• CVE-2021-21802This vulnerability is present in device_graph_page.php scrip…6.1