CVE-2026-8733: SlimPDFReader Buffer Overflow Vulnerability

CVE-2026-8733 Overview

CVE-2026-8733 is a stack-based buffer overflow [CWE-119] in Investintech SlimPDFReader versions up to 2.0.13. The flaw resides in the sub_3B4610 function within SlimPDFReader.exe. An attacker can trigger the overflow remotely by inducing a user to open a crafted PDF document. Public exploit details have been released, increasing the practical risk for environments still running the application. The vendor responded to the original report by confirming the product is discontinued and will not receive a patch. This vulnerability only affects unsupported software.

Critical Impact

Remote stack-based memory corruption with public exploit details available in a discontinued PDF reader that will not be patched.

Affected Products

• Investintech SlimPDFReader up to and including version 2.0.13
• SlimPDFReader.exe binary containing the vulnerable sub_3B4610 function
• All deployments of SlimPDFReader (product is discontinued)

Discovery Timeline

• 2026-05-17 - CVE-2026-8733 published to the National Vulnerability Database (NVD)
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8733

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in the sub_3B4610 function inside SlimPDFReader.exe. The function fails to enforce correct bounds when copying attacker-controlled data into a fixed-size stack buffer. An attacker delivers a crafted PDF file to the victim. When the user opens the file, the parser invokes sub_3B4610 and writes past the buffer boundary on the stack.

Stack-based overflows of this class can corrupt saved return addresses, structured exception handler (SEH) records, and adjacent local variables. The result ranges from process termination to arbitrary code execution in the context of the local user. The classification under [CWE-119] reflects improper restriction of operations within memory bounds. Because the vendor has discontinued the product, no official fix is planned.

Root Cause

The root cause is the absence of bounds checking in sub_3B4610 when handling input parsed from a PDF document. The function copies variable-length data into a fixed stack allocation without validating the source length against the destination size. Standard hardening measures such as stack cookies, SafeSEH, and Address Space Layout Randomization (ASLR) determine the difficulty of weaponizing the overflow into reliable code execution.

Attack Vector

Exploitation requires the victim to open a malicious PDF in SlimPDFReader. The attack is network-deliverable through email attachments, web downloads, or shared file repositories. User interaction is required, but no authentication or local access is needed. Public exploit material lowers the barrier for opportunistic attackers targeting environments that retain the discontinued reader.

No verified proof-of-concept code is available in the source data for inclusion. Refer to the Fraunhofer Sharing Document and the VulDB Vulnerability #364321 record for additional technical references.

Detection Methods for CVE-2026-8733

Indicators of Compromise

• Unexpected crashes of SlimPDFReader.exe with access violation or stack corruption exceptions in Windows Error Reporting (WER) logs
• Child processes spawned by SlimPDFReader.exe such as cmd.exe, powershell.exe, or other living-off-the-land binaries
• PDF files arriving from untrusted sources that are opened by users with SlimPDFReader as the default handler

Detection Strategies

• Inventory all endpoints for the presence of SlimPDFReader.exe and any version up to 2.0.13 using software asset management or endpoint queries
• Monitor process creation events where the parent image is SlimPDFReader.exe and the child process is a shell, scripting host, or network utility
• Inspect email gateways and web proxies for PDF attachments and downloads destined for hosts known to run the affected reader

Monitoring Recommendations

• Enable detailed process and module load logging on hosts with the application installed and forward events to a centralized SIEM
• Alert on SlimPDFReader.exe crash events and correlate with recent PDF file open activity to identify possible exploitation attempts
• Track outbound network connections initiated by SlimPDFReader.exe or its child processes, which is atypical for a PDF viewer

How to Mitigate CVE-2026-8733

Immediate Actions Required

• Uninstall Investintech SlimPDFReader from all endpoints, as the product is discontinued and no patch will be issued
• Replace SlimPDFReader with a supported, actively maintained PDF reader and reassign the default .pdf file handler
• Block delivery of PDFs from untrusted external sources at email and web gateways until removal is complete

Patch Information

No patch is available. The vendor confirmed to the original reporter that SlimPDFReader is discontinued and will not receive security updates. Removal is the only sanctioned remediation. Reference the VulDB Vulnerability #364321 record for vendor response details.

Workarounds

• Remove or disable SlimPDFReader.exe on all systems where uninstallation cannot occur immediately
• Apply application allowlisting to prevent SlimPDFReader.exe from executing on managed endpoints
• Restrict the ability of SlimPDFReader.exe to spawn child processes or initiate outbound network connections through endpoint policy

# Configuration example: Windows uninstall and handler reassignment
# 1. Silent uninstall via WMIC (run as administrator)
wmic product where "name like 'Slim PDF Reader%%'" call uninstall /nointeractive

# 2. Confirm the binary is removed
where SlimPDFReader.exe

# 3. Reassign the default PDF handler (example: Microsoft Edge)
ftype AcroExch.Document.DC="C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "%1"
assoc .pdf=AcroExch.Document.DC