CriticalPublic exploit

DLL Search Path Hijacking in Corel PDF Fusion 1.11

IdentifiersCVE-2013-3248CWE-427

Corel PDF Fusion 1.11 contains an untrusted search path vulnerability when resolving wintab32.dll. A local user can place a Trojanized DLL in the current working directory associated with a directory containing a PDF or XPS file, causing the application to load the attacker-controlled library and enabling privilege gain.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local user to gain privileges through execution of a Trojanized wintab32.dll loaded from the current working directory.

Mitigation

If you can’t patch tonight, do this now.

As a temporary mitigation, avoid opening untrusted .pdf or .xps files from directories where untrusted DLLs may be present. Restrict write access to directories used for opening documents and use application whitelisting to prevent execution of unauthorized DLLs.

Remediation

Patch, then assume compromise.

Update Corel PDF Fusion to a version that properly validates the DLL search path and does not load libraries from the current working directory. If no patch is available, contact the vendor for further guidance.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

corelpdf_fusion_bof.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (corelpdf_fusion_bof.rb) that exploits a stack-based buffer overflow vulnerability (CVE-2013-3248) in Corel PDF Fusion version 1.11 on Windows XP SP3. The exploit works by generating a specially crafted XPS file (default name: msf.xps) with an overlong entry name in the 'Resources/' directory, embedding a customizable Metasploit payload. When a victim opens this file with the vulnerable application, arbitrary code is executed as the target user. The module is operational, allowing for payload customization, and is intended for use in social engineering scenarios where the attacker must convince the victim to open the malicious file. The code is written in Ruby and leverages Metasploit's FILEFORMAT and SEH exploitation mixins. No network endpoints are involved; the attack vector is local, requiring user interaction with the crafted file.

Disclosed Jul 8, 2013rubylocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Corel CorporationPdf Fusionapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity