High severity · published Oct 9, 2024
CVE-2024-35288
Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Nitro Pdf Pro · Gonitro
before 13.70.8.82; 14.0 before 14.26.1.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-35288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-35288
sec-consult.com
https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-nitro-pdf-pro/
seclists.org
https://seclists.org/fulldisclosure/2024/Sep/59
www.gonitro.com
https://www.gonitro.com/support/downloads#securityUpdates
seclists.org
http://seclists.org/fulldisclosure/2024/Sep/59
More from Nitro Pdf Pro
8.4
CVE-2025-69627
Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc()
7.8
CVE-2016-8713
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10.5.9.9
7.8
CVE-2016-8711
A potential remote code execution vulnerability exists in the PDF parsing functionality of Nitro Pro 10
7.8
CVE-2016-8709
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10
7.5
CVE-2025-66769
A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet