Investintech SlimPDFReader contains a stack-based buffer overflow in the sub_3B4610 function of SlimPDFReader.exe. The flaw allows an attacker to overflow the stack and potentially execute arbitrary code when the program processes a maliciously crafted PDF. This weakness is classified as CWE‑119 and CWE‑121 and could be leveraged to compromise the confidentiality, integrity, or availability of the affected system if an attacker succeeds.

All installations of Investintech SlimPDFReader up to and including version 2.0.13 are affected. The product has been discontinued and is no longer supported by the vendor, meaning no official patches will be released.

The CVSS base score is 5.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, which suggests no widespread exploitation at the time of this analysis. However, the flaw has a public exploit and can be triggered remotely, so the attack vector is likely over the network or via a malicious PDF delivered through any remote channel.