CVE Feed

    Dashboard / CVE / CVE-2024-35288

    CVE-2024-35288

    Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM.

    Published:Oct 9, 2024
    Last Modified:Apr 15, 2026
    EPS:Oct 9, 2024
    EPSS Score:0.00256
    CVSS Score:7.8

    Affected Products

    Vendor
    Gonitro
    Product
    Nitro Pdf Pro

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-69624 (CVSS 7.5) — Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript imp…
    CVE-2025-69627 (CVSS 8.4) — Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the …
    CVE-2025-66769 (CVSS 7.5) — A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Servi…
    CVE-2025-67825 (CVSS 5.5) — An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it displays signer i…
    CVE-2016-8713 (CVSS 7.8) — A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro…
    CVE-2016-8709 (CVSS 7.8) — A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro…
    CVE-2016-8711 (CVSS 7.8) — A potential remote code execution vulnerability exists in the PDF parsing functionality of Nitro Pro 10. A spe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High