CVE-2017-7894 WinDjView 2.1 might allow user-assisted attackers to execute code via a crafted .djvu file, because of a "User Mode Write AV near NULL" in WinDjView.exe. One threat model is a victim who obtains an un...
HighCVSS 7.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
WinDjView 2.1 might allow user-assisted attackers to execute code via a crafted .djvu file, because of a "User Mode Write AV near NULL" in WinDjView.exe. One threat model is a victim who obtains an untrusted .djvu file from a remote location and issues several user-defined commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| windjview project windjview | = 2.1 | No fix listed |
References
- github.com third-party-advisory