The Portable Document Format (PDF) specification does not provide any...

5.3 CVSS

Vulnerability Description

The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or annotations, Body Updates are displayed to the user without any action by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects LibreOffice, Master PDF Editor, Nitro Pro, Nitro Reader, Nuance Power PDF Standard, PDF Editor 6 Pro, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, Perfect PDF 10 Premium, and Perfect PDF Reader.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18688

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

code-industry

View all reports →

Affected Software

master pdf editor, foxit reader, phantompdf, nitro pro, nitro reader, pdf editor 6, pdfelement6, libreoffice, power pdf standard, pdf studio, pdf studio viewer 2018, perfect pdf 10, perfect pdf reader

Vulnerable Versions:

5.1.12, 5.1.68, 5.1.24, 9.4, 9.1.0, 9.2.0, 9.0, 8.3.9, 11.0.3.173, 5.5.9.2, 6.4.2.3521, 6.6.2.3315, 6.7.6.3399, 6.8.0.3523, 6.8.4.3921, 6.7.1.3355, 6.0.6.2, 6.1.3.2, 6.1.0.3, 3.0.0.17, 3.0.0.30, 7.0, 12.0.7, 2018.0.1, 2018.2.0, 10.0.0.1, 13.0.3, 13.1.5

Timeline

Official Publish: January 7th, 2021

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.