Cyber Resilience

CVE-2020-6113

Memory Safety in Gonitro Nitro Pro 13.13.2.242 … 13.16.2.300

Public PoCHigh EPSSMemory Safety
Published
17 September 2020
Modified
21 November 2024
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.69 99.3th percentile
Risk Priority 80 floored blend · peak EPSS

Summary

CVE-2020-6113 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Gonitro Nitro Pro. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to…

more

allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1203 Exploitation for Client Execution Executionconfidence: HIGH
Integer overflow during PDF object stream parsing leads to memory corruption and code execution upon opening a crafted document.
T1204.002 Malicious File Executionconfidence: HIGH
Victim must open the specially crafted malicious PDF file to trigger the vulnerability.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-6146Same product: Gonitro Nitro Pro
CVE-2026-45784Shared CWE-131, CWE-787
CVE-2024-30949Shared CWE-190, CWE-787
CVE-2024-46729Shared CWE-131, CWE-787
CVE-2023-45681Shared CWE-190, CWE-787
CVE-2024-32913Shared CWE-190, CWE-787
CVE-2023-35681Shared CWE-190, CWE-787
CVE-2026-34589Shared CWE-190, CWE-787
CVE-2023-47212Shared CWE-190, CWE-787
CVE-2024-43091Shared CWE-190, CWE-787

Affected Assets

gonitro
nitro pro
13.13.2.242, 13.16.2.300

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.2.6

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.

PR.PS-02 partial match
prevents

Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Secure coding standards directly require correct buffer-size calculations.

detects

Security testing in development can detect integer overflows before release.

prevents

Secure SDLC mandates input validation and arithmetic checks that prevent integer overflows.

degrades

Application security requirements include bounds checking and safe arithmetic to avoid overflow conditions.

degrades

Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.

prevents

Change management can enforce review gates that catch unsafe memory operations before deployment.

References