Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-5019: Rainbow PDF Office Server Document Converter can run malicious code

CVE-2019-5019 · published 7 years ago

Summary

The PowerPoint conversion feature in Rainbow PDF Office Server Document Converter version 7.0 can be tricked into writing data to the wrong place in memory. This could let an attacker execute their own code on the server, potentially taking control of the system. Update the software to the latest patched version or disable the PowerPoint conversion function until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
rainbowpdf	office_server_document_converter	7.0 `cpe:2.3:a:rainbowpdf:office_server_document_converter:7.0:r1::::::`

Original advisory text

A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7,0,2018,1113). While parsing Document Summary Property Set stream, the getSummaryInformation function is incorrectly checking the correlation between size and the number of properties in PropertySet packets, causing an out-of-bounds write that leads to heap corruption and consequent code execution.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0780 Exploit Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

CWE-787Out-of-bounds Write

Timeline

Published7 Mar 2019

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2019-5019 · NVD

Track software like this

Free during beta