Synactis PDF In-The-Box PDF_IN_1.ocx ConnectToSynactis ldCmdLine stack-based overflow

Summaryinfo

A vulnerability was found in Synactis PDF In-The-Box. It has been classified as critical. Affected by this issue is the function ConnectToSynactis in the library PDF_IN_1.ocx. Performing a manipulation of the argument ldCmdLine results in stack-based overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is identified as CVE-2013-10057. The attack can be initiated remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in Synactis PDF In-The-Box (unknown version). It has been classified as critical. This affects the function ConnectToSynactis in the library PDF_IN_1.ocx. The manipulation of the argument ldCmdLine with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifically the ConnectToSynactis method. When a long string is passed to this method—intended to populate the ldCmdLine argument of a WinExec call—a strcpy operation overwrites a saved TRegistry class pointer on the stack. This allows remote attackers to execute arbitrary code in the context of the user by enticing them to visit a malicious webpage that instantiates the vulnerable ActiveX control. The vulnerability was discovered via its use in third-party software such as Logic Print 2013.

The weakness was released by h1ch4m. The advisory is shared at raw.githubusercontent.com. This vulnerability is uniquely identified as CVE-2013-10057 since 08/01/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (25835) and EUVD (EUVD-2013-7261). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Synactis

Name

• PDF In-The-Box

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion