CVE-2026-13522: SlimPDFReader Out-of-Bounds Read Vulnerability – Unsupported Product Alert

Technical summary

CVE-2026-13522 is an out-of-bounds read vulnerability (CWE-119, CWE-125) in Investintech SlimPDFReader's PDF processing engine. The flaw resides in the TeighaDo function within the PDF File Handler component of SlimPDFReader.exe. When parsing a specially crafted PDF file, the application fails to properly validate buffer boundaries, allowing an attacker to read memory beyond allocated regions. The vulnerability is triggered through file-level manipulation and carries a CVSS 3.1 score of 4.3 (Medium severity) with a network attack vector, low complexity, no privilege requirement, and user interaction needed. The impact is limited to availability (denial of service via application crash).

Business impact

For organizations using SlimPDFReader, this vulnerability presents a denial-of-service risk. Malicious PDFs circulated via email or document repositories could crash the application during normal workflow, disrupting productivity. While confidentiality and integrity impacts are not indicated by the CVSS vector, out-of-bounds reads in memory-unsafe code can sometimes leak sensitive data depending on what resides in adjacent memory regions. The critical business factor here is unsupportability: with SlimPDFReader no longer maintained, there will be no vendor-issued patches, leaving affected deployments permanently exposed unless the organization migrates to an actively supported PDF reader.

Affected systems

Investintech SlimPDFReader versions 2.0.14 and earlier are affected. Organizations should inventory any systems where this application is installed, particularly on workstations where employees receive external PDF documents. This includes Windows systems running the SlimPDFReader.exe component. Given the end-of-life status, the affected version range is the complete supported history of the product.

Exploitability

Exploitation requires an attacker to deliver a crafted PDF file to a user and convince them to open it—a moderate bar that phishing, watering hole attacks, and document repositories make achievable. The attack vector is network-based with low complexity and no special privileges needed. However, the vulnerability does not appear in the CISA KEV catalog, suggesting real-world exploitation has not yet been publicly documented. The out-of-bounds read condition must be carefully constructed to trigger the specific memory access flaw, indicating some attack sophistication is required, though PDF fuzzing tools could facilitate this.

Remediation

Because SlimPDFReader is no longer supported, the only reliable remediation is to migrate to an actively maintained PDF reader such as Adobe Reader, Foxit Reader, or open-source alternatives like PDF.js or LibreOffice Draw. Organizations should prioritize uninstalling SlimPDFReader where possible and establishing a standard PDF viewer policy. For environments where legacy document archives require SlimPDFReader, consider air-gapping those systems or restricting external PDF input to trusted sources only.

Patch guidance

No patch is available from Investintech, as the product is no longer maintained. Do not expect a security update. The only path forward is product replacement. Verify that any successor PDF tools are configured with the latest security updates from their respective vendors. If you are currently using SlimPDFReader, begin migration planning immediately.

Detection guidance

Monitor for SlimPDFReader.exe crashes or hangs triggered by PDF file opens, which may indicate exploitation attempts. Deploy email gateway rules to detect and quarantine suspicious PDF files, particularly those with unusual embedded scripts or obfuscated content. Use endpoint detection and response (EDR) tools to identify abnormal memory access patterns or process crashes related to SlimPDFReader. Consider file integrity monitoring on document repositories to catch suspicious PDF modifications. Additionally, audit systems to identify all installations of SlimPDFReader so you can prioritize removal.

Why prioritize this

Although the CVSS score is 4.3 (Medium), the end-of-life status elevates priority significantly. Organizations with SlimPDFReader in production face a permanent, unpatched exposure. The attack vector (network, user interaction) is manageable but realistic in document-heavy workflows. Prioritize inventory and migration planning over reactive patching, since no patch exists. The lack of KEV listing suggests this is not yet being actively exploited, providing a window to act proactively rather than reactively.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability with low attack complexity and user interaction requirement, limited to availability impact. However, this score does not fully capture the business risk of unsupportability. An organization running unpatched, end-of-life software faces indefinite exposure. The Medium severity classification is technically accurate for the memory corruption itself, but the strategic risk of product obsolescence should weigh heavily in your internal risk prioritization process.

Frequently asked questions