CVE-2019-25550

Encrypt PDF 2.3 contains a buffer overflow vulnerability that allows local attackers to crash the application by inputting excessively long strings into password fields. Attackers can paste a 1000-byte buffer into the User Password or Master Password field in the Settings dialog to trigger an application crash when importing PDF files.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.verypdf.com	Product
https://www.exploit-db.com/exploits/46871	Exploit VDB Entry
https://www.vulncheck.com/advisories/encrypt-pdf-denial-of-service-via-buffer-overflow	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:verypdf:encrypt_pdf:2.3:*:*:*:*:*:*:*

History

16 Apr 2026, 17:53

Type	Values Removed	Values Added
Summary		(es) Encrypt PDF 2.3 contiene una vulnerabilidad de desbordamiento de búfer que permite a atacantes locales bloquear la aplicación al introducir cadenas excesivamente largas en los campos de contraseña. Los atacantes pueden pegar un búfer de 1000 bytes en el campo de Contraseña de usuario o Contraseña maestra en el diálogo de Configuración para provocar un bloqueo de la aplicación al importar archivos PDF.
CPE		cpe:2.3:a:verypdf:encrypt_pdf:2.3:::::::*
References	~~() http://www.verypdf.com -~~	() http://www.verypdf.com - Product
References	~~() https://www.exploit-db.com/exploits/46871 -~~	() https://www.exploit-db.com/exploits/46871 - Exploit, VDB Entry
References	~~() https://www.vulncheck.com/advisories/encrypt-pdf-denial-of-service-via-buffer-overflow -~~	() https://www.vulncheck.com/advisories/encrypt-pdf-denial-of-service-via-buffer-overflow - Third Party Advisory
First Time		Verypdf encrypt Pdf Verypdf

21 Mar 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-21 13:16

Updated : 2026-04-16 17:53

NVD link : CVE-2019-25550

Mitre link : CVE-2019-25550

CVE.ORG link : CVE-2019-25550

JSON object : View

Products Affected

verypdf

encrypt_pdf

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-25550", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-21T13:16:17.147", "references": [{"url": "http://www.verypdf.com", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/46871", "tags": ["Exploit", "VDB Entry"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/encrypt-pdf-denial-of-service-via-buffer-overflow", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Encrypt PDF 2.3 contains a buffer overflow vulnerability that allows local attackers to crash the application by inputting excessively long strings into password fields. Attackers can paste a 1000-byte buffer into the User Password or Master Password field in the Settings dialog to trigger an application crash when importing PDF files."}, {"lang": "es", "value": "Encrypt PDF 2.3 contiene una vulnerabilidad de desbordamiento de b\u00fafer que permite a atacantes locales bloquear la aplicaci\u00f3n al introducir cadenas excesivamente largas en los campos de contrase\u00f1a. Los atacantes pueden pegar un b\u00fafer de 1000 bytes en el campo de Contrase\u00f1a de usuario o Contrase\u00f1a maestra en el di\u00e1logo de Configuraci\u00f3n para provocar un bloqueo de la aplicaci\u00f3n al importar archivos PDF."}], "lastModified": "2026-04-16T17:53:07.683", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:verypdf:encrypt_pdf:2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C22253A5-8E55-4C6F-85F4-60206E815859"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}