Remote Code Execution Vulnerability in Bitdefender Antivirus Software
CVE-2017-10954

8.8HIGH

Key Information:

Vendor

Bitdefender

Status
Bitdefender Internet Security
Vendor
CVE Published:
31 October 2017

What is CVE-2017-10954?

This vulnerability in Bitdefender Internet Security 2018 allows remote attackers to execute arbitrary code by exploiting a flaw in the pdf.xmd component. By tricking users into visiting a malicious web page or opening a harmful file, attackers can manipulate user-supplied data leading to an integer overflow. This overflow can occur before allocating a buffer, enabling the execution of code in the context of the SYSTEM. It's essential for users to update to build 7.72918 or later to mitigate this risk.

Affected Version(s)

Bitdefender Internet Security Internet Security 2018 prior to build 7.72918

References

https://zerodayinitiative.com/advisories/ZDI-17-717
x_refsource_MISC
http://www.securityfocus.com/bid/100676
vdb-entryx_refsource_BID

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.