Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Able2Extract Professional 14.0.7 runs code from crafted BMP

CVE-2019-5088 · published 7 years ago
Summary

The Able2Extract Professional 14.0.7 application can be tricked by a specially‑made BMP image into writing data outside its memory area. This could let an attacker run any program they choose on the victim's computer. Do not open BMP files from unknown sources and apply the latest update from the vendor as soon as it is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
investintech able2extract 14.0.7
cpe:2.3:a:investintech:able2extract:14.0.7:*:*:*:professional:*:x64:*
Original advisory text
An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional 14.0.7 x64. A specially crafted BMP file can cause an out-of-bounds memory write, allowing a potentia...
An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional 14.0.7 x64. A specially crafted BMP file can cause an out-of-bounds memory write, allowing a potential attacker to execute arbitrary code on the victim machine. Can trigger this vulnerability by sending the user a specially crafted BMP file.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published5 Nov 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-5088 · NVD
Track software like this
Free during beta