CVE-2026-13522 Overview
CVE-2026-13522 is an out-of-bounds read vulnerability in Investintech SlimPDFReader through version 2.0.14. The flaw resides in the SlimPDFReader!Investintech::PCV::TeighaDo+0x25cde0 function within SlimPDFReader.exe, which handles PDF file parsing. An attacker can craft a malicious PDF that, when opened by a user, triggers a read beyond allocated memory boundaries. The vulnerability requires user interaction but can be initiated remotely by delivering the crafted file. This product line is no longer supported by the maintainer, so no vendor patch is expected.
Critical Impact
A crafted PDF opened in SlimPDFReader triggers an out-of-bounds read in the PDF file handler, potentially leaking process memory or causing application instability. The affected product is end-of-life and will not receive fixes.
Affected Products
- Investintech SlimPDFReader versions up to and including 2.0.14
- SlimPDFReader.exe PDF File Handler component
- Unsupported/end-of-life SlimPDFReader builds on Windows
Discovery Timeline
- 2026-06-29 - CVE-2026-13522 published to the National Vulnerability Database (NVD)
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-13522
Vulnerability Analysis
The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and manifests as an out-of-bounds read. Triggering the flaw requires a user to open a crafted PDF document in SlimPDFReader. The vulnerable code path lies in the Teigha-based PDF parsing routine referenced as SlimPDFReader!Investintech::PCV::TeighaDo+0x25cde0.
Out-of-bounds read primitives typically expose adjacent process memory. In this context the impact is limited to availability and potential information exposure from the reader process. The CVSS 4.0 vector indicates network delivery with passive user interaction and low availability impact, without integrity or confidentiality impact to the host.
The EPSS score is 0.293% at the 21st percentile, reflecting a low observed exploitation likelihood. No public proof-of-concept or in-the-wild exploitation has been reported. See the VulDB entry for CVE-2026-13522 for additional technical detail.
Root Cause
The root cause is missing or insufficient bounds checking inside the Teigha PDF parsing logic embedded in SlimPDFReader. When the parser processes attacker-controlled structures in a PDF stream, it dereferences an offset that lies outside the intended buffer. Because the product is no longer maintained, upstream Teigha bounds-checking improvements are not being backported.
Attack Vector
Exploitation follows a standard client-side file format attack pattern. An attacker hosts or emails a malicious PDF. The victim opens the file in a vulnerable SlimPDFReader installation. The parser reads beyond a valid buffer, causing a crash or leaking memory contents.
No verified exploitation code is available. The vulnerability is described in prose only, consistent with the VulDB submission referenced in the advisory.
Detection Methods for CVE-2026-13522
Indicators of Compromise
- Unexpected SlimPDFReader.exe process crashes with faulting module offsets near Investintech::PCV::TeighaDo+0x25cde0
- Windows Error Reporting (WER) or AppCrash events referencing SlimPDFReader.exe immediately after a PDF is opened
- Delivery of PDF attachments from untrusted senders followed by SlimPDFReader process termination
Detection Strategies
- Hunt endpoint telemetry for SlimPDFReader.exe executions where the parent is a mail client, browser, or archive utility
- Correlate crash dumps referencing the Teigha parsing symbols with recent PDF file writes to user download or temp directories
- Flag any presence of SlimPDFReader binaries with versions at or below 2.0.14, since the product is end-of-life
Monitoring Recommendations
- Enable process, module load, and crash event collection on hosts where legacy PDF readers are still deployed
- Monitor email and web gateways for PDF attachments delivered to users with SlimPDFReader installed
- Alert when SlimPDFReader is launched on systems where an approved, supported PDF reader is standard
How to Mitigate CVE-2026-13522
Immediate Actions Required
- Inventory all endpoints for SlimPDFReader.exe and record versions
- Uninstall SlimPDFReader from user workstations and replace it with a supported PDF reader
- Reassociate the .pdf file handler to a maintained application via Group Policy or MDM
Patch Information
No patch is available. Investintech no longer supports the affected SlimPDFReader product line, and the vendor will not issue a fix for CVE-2026-13522. Migration to a supported PDF reader is the only durable remediation. Refer to the VulDB advisory for reference metadata.
Workarounds
- Block delivery of untrusted PDFs at the email gateway or apply attachment sandboxing before delivery to end users
- Restrict execution of SlimPDFReader.exe through application control policies such as Windows Defender Application Control or AppLocker
- Train users to avoid opening PDF files from unknown sources until the legacy reader has been removed
# Example AppLocker rule to block the unsupported reader by publisher/path
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
-Path "%PROGRAMFILES%\Investintech\SlimPDFReader\SlimPDFReader.exe"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
