VIR Vulnerability Intelligence Relay

CVE-2012-6535

critical
Published 2013-12-02 · Modified 2026-04-29
CVSS v3
—
CVSS v2
9.3
VIR risk
9.3

Description

DjVuLibre before 3.5.25.3, as used in Evince, Sumatra PDF Reader, VuDroid, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DjVu (aka .djv) file.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2012-6535

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://technet.microsoft.com/security/msvr/msvr13-004

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed3.5.25.3-1
debian debianbullseyefixed3.5.25.3-1
debian debianforkyfixed3.5.25.3-1
debian debiansidfixed3.5.25.3-1
debian debiantrixiefixed3.5.25.3-1

Application impact
VendorProductVersionsFixed
djvulibre_projectdjvulibre{"endIncluding":"3.5.25"}
djvulibre_projectdjvulibre3.5.1
djvulibre_projectdjvulibre3.5.2
djvulibre_projectdjvulibre3.5.3
djvulibre_projectdjvulibre3.5.4
djvulibre_projectdjvulibre3.5.5
djvulibre_projectdjvulibre3.5.6
djvulibre_projectdjvulibre3.5.7
djvulibre_projectdjvulibre3.5.8
djvulibre_projectdjvulibre3.5.9
djvulibre_projectdjvulibre3.5.10
djvulibre_projectdjvulibre3.5.11
djvulibre_projectdjvulibre3.5.12
djvulibre_projectdjvulibre3.5.13
djvulibre_projectdjvulibre3.5.14
djvulibre_projectdjvulibre3.5.15
djvulibre_projectdjvulibre3.5.16
djvulibre_projectdjvulibre3.5.17
djvulibre_projectdjvulibre3.5.18
djvulibre_projectdjvulibre3.5.19
djvulibre_projectdjvulibre3.5.20
djvulibre_projectdjvulibre3.5.21
djvulibre_projectdjvulibre3.5.22
djvulibre_projectdjvulibre3.5.23
djvulibre_projectdjvulibre3.5.24

References

CWEs

CWE-94

Verify integrity in audit chain (admin only). AS-IS.