Memory Corruption Vulnerability in Able2Extract Professional by Investintech
CVE-2019-5089

8.8HIGH

Key Information:

Vendor

Investintech Inc.

Status
Able2extract Professional
Vendor
CVE Published:
5 November 2019

What is CVE-2019-5089?

Investintech's Able2Extract Professional version 4.0.7 x64 has a memory corruption vulnerability that can be exploited through a specially crafted JPEG file. When processed, this file can cause an out-of-bounds memory write, allowing attackers to execute arbitrary code on a victim's machine. Users are cautioned to avoid opening untrusted JPEG files to mitigate the risk of exploitation.

Affected Version(s)

Able2Extract Professional 14.0.7 x64

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.