CVE-2019-25549

VeryPDF PCL Converter 2.7 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long password string. Attackers can trigger a buffer overflow by entering a 3000-byte password in the PDF Security encryption fields, causing the application to crash when processing PCL files.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.verypdf.com	Product
https://www.exploit-db.com/exploits/46872	Exploit VDB Entry
https://www.vulncheck.com/advisories/verypdf-pcl-converter-denial-of-service-via-pdf-security	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:verypdf:verypdf:2.7:*:*:*:*:*:*:*

History

16 Apr 2026, 17:52

Type	Values Removed	Values Added
References	~~() http://www.verypdf.com -~~	() http://www.verypdf.com - Product
References	~~() https://www.exploit-db.com/exploits/46872 -~~	() https://www.exploit-db.com/exploits/46872 - Exploit, VDB Entry
References	~~() https://www.vulncheck.com/advisories/verypdf-pcl-converter-denial-of-service-via-pdf-security -~~	() https://www.vulncheck.com/advisories/verypdf-pcl-converter-denial-of-service-via-pdf-security - Third Party Advisory
First Time		Verypdf verypdf Verypdf
CPE		cpe:2.3:a:verypdf:verypdf:2.7:::::::*
Summary		(es) VeryPDF PCL Converter 2.7 contiene una vulnerabilidad de denegación de servicio que permite a atacantes locales bloquear la aplicación al proporcionar una cadena de contraseña excesivamente larga. Los atacantes pueden desencadenar un desbordamiento de búfer al introducir una contraseña de 3000 bytes en los campos de cifrado de seguridad de PDF, lo que provoca que la aplicación se bloquee al procesar archivos PCL.

21 Mar 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-21 13:16

Updated : 2026-04-16 17:52

NVD link : CVE-2019-25549

Mitre link : CVE-2019-25549

CVE.ORG link : CVE-2019-25549

JSON object : View

Products Affected

verypdf

verypdf

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-25549", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-21T13:16:16.980", "references": [{"url": "http://www.verypdf.com", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/46872", "tags": ["Exploit", "VDB Entry"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/verypdf-pcl-converter-denial-of-service-via-pdf-security", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "VeryPDF PCL Converter 2.7 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long password string. Attackers can trigger a buffer overflow by entering a 3000-byte password in the PDF Security encryption fields, causing the application to crash when processing PCL files."}, {"lang": "es", "value": "VeryPDF PCL Converter 2.7 contiene una vulnerabilidad de denegaci\u00f3n de servicio que permite a atacantes locales bloquear la aplicaci\u00f3n al proporcionar una cadena de contrase\u00f1a excesivamente larga. Los atacantes pueden desencadenar un desbordamiento de b\u00fafer al introducir una contrase\u00f1a de 3000 bytes en los campos de cifrado de seguridad de PDF, lo que provoca que la aplicaci\u00f3n se bloquee al procesar archivos PCL."}], "lastModified": "2026-04-16T17:52:50.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:verypdf:verypdf:2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "186644DB-F04B-488D-8F93-DF83E3A76677"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}