CVEs-PoC/2020/CVE-2020-6112.md

### [CVE-2020-6112](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6112)
![](https://img.shields.io/static/v1?label=Product&message=Nitro%20Pro&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-823%3A%20Use%20of%20Out-of-range%20Pointer%20Offset&color=brighgreen)

### Description

An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which allow for the decoder to write out of-bounds and cause memory corruption. This can result in code execution. A specially crafted image can be embedded inside a PDF and loaded by a victim in order to trigger this vulnerability.

### POC

#### Reference
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1062

#### Github
No PoCs found on GitHub currently.