CVE-2026-13522

{
  "id": "CVE-2026-13522",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T02:16:25.557",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [
    {
      "sourceIdentifier": "[email protected]",
      "tags": [
        "unsupported-when-assigned"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security flaw has been discovered in Investintech SlimPDFReader up to 2.0.14. Affected by this issue is the function SlimPDFReader!Investintech::PCV::TeighaDo+0x25cde0 of the file SlimPDFReader.exe of the component PDF File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer."
    },
    {
      "lang": "es",
      "value": "Una falla de seguridad ha sido descubierta en Investintech SlimPDFReader hasta la versión 2.0.14. Este problema afecta a la función SlimPDFReader!Investintech::PCV::TeighaDo+0x25cde0 del archivo SlimPDFReader.exe del componente Gestor de Archivos PDF. Al realizar una manipulación, se provoca una lectura fuera de límites. Es posible iniciar el ataque remotamente. Esta vulnerabilidad solo afecta a productos que ya no tienen soporte por parte del mantenedor."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Investintech",
          "product": "SlimPDFReader",
          "cpes": [
            "cpe:2.3:a:investintech:slimpdfreader:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "PDF File Handler"
          ],
          "versions": [
            {
              "version": "2.0.0",
              "status": "affected"
            },
            {
              "version": "2.0.1",
              "status": "affected"
            },
            {
              "version": "2.0.2",
              "status": "affected"
            },
            {
              "version": "2.0.3",
              "status": "affected"
            },
            {
              "version": "2.0.4",
              "status": "affected"
            },
            {
              "version": "2.0.5",
              "status": "affected"
            },
            {
              "version": "2.0.6",
              "status": "affected"
            },
            {
              "version": "2.0.7",
              "status": "affected"
            },
            {
              "version": "2.0.8",
              "status": "affected"
            },
            {
              "version": "2.0.9",
              "status": "affected"
            },
            {
              "version": "2.0.10",
              "status": "affected"
            },
            {
              "version": "2.0.11",
              "status": "affected"
            },
            {
              "version": "2.0.12",
              "status": "affected"
            },
            {
              "version": "2.0.13",
              "status": "affected"
            },
            {
              "version": "2.0.14",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "baseScore": 5.0,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T13:41:33.467112Z",
          "id": "CVE-2026-13522",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        },
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://vuldb.com/cve/CVE-2026-13522",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/submit/839637",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/374530",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/374530/cti",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/submit/839637",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}