Is CVE-2020-6146 actively exploited?

No active exploitation of CVE-2020-6146 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-6146 be exploited remotely?

Yes. CVE-2020-6146 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-6146?

CVE-2020-6146 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2020-6146

HIGH

CVE-2020-6146

CWE-122Published: September 16, 2020· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300. When drawing the contents of a page and selecting the stroke color from an 'ICCBased' colorspace, the application will read a length from the file and use it as a loop sentinel when writing data into the member of an object. Due to the object member being a buffer of a static size allocated on the heap, this can result in a heap-based buffer overflow. A specially crafted document must be loaded by a victim in order to trigger this vulnerability.

NVD Source

Technical Analysis

CVE-2020-6146 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.