CVE-2018-7264

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.09.8Critical EPSS percentile96th12% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixNone yetNo fix or workaround published

Published 2018-02-28Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your software uses the ActivePDF toolkit to process or convert images provided by customers/users (untrusted images).
Identify your ActivePDF toolkit version in your application, vendor package, or update records.
Upgrade ActivePDF toolkit to version 8.1.0.19023 or later.
If you can’t upgrade immediately, stop processing untrusted images with the ActivePDF toolkit until patched (or route uploads through a safer conversion step outside ActivePDF).

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and sign errors, allowing a remote attacker to execute arbitrary code on vulnerable applications using the ActivePDF Toolkit to process untrusted images.

In plain language

Written by AI from the record

CVE-2018-7264 is a serious remote code execution bug in the ActivePDF toolkit’s image processing (Pictview) found in versions up to 2018.1.0.18321; if your business processes untrusted images through this toolkit, you should update to the fixed version.

ActivePDF toolkit (embedded Pictview image processing) through 2018.1.0.18321 has memory-safety issues (out-of-bounds writes / sign errors) that enable remote code execution when it processes untrusted images; public exploits exist.

If you're affected

Full system compromise
Malware installation
Data theft risk
Business disruption

What is it

This flaw is like a mistake in an image “decoder” that can be tricked by a specially crafted image. If your system uses the ActivePDF toolkit to open or convert images people upload (or otherwise supply), an attacker may be able to break out of that image processing and run their own code on your server.

Who is affected

This matters if you use ActivePDF toolkit to process images from the outside (for example, customer uploads, user-supplied files, or downloaded images). The risk applies when untrusted images reach the toolkit’s image processing path.

Because public exploit code exists, you should treat this as actionable if the affected component is reachable in your workflow.

How urgent is it

This is AMBER because public exploit code is available for a critical remote code execution issue. If your business processes untrusted images through ActivePDF toolkit, attackers may be able to target you without needing logins.

Update to the fixed version as your priority, and don’t leave untrusted image handling exposed in the meantime.

What to do — in detail

Confirm whether you’re exposed
- Review your apps/services that handle PDFs/images and identify whether ActivePDF toolkit is used for image processing (especially opening, decoding, converting, or transforming user-provided images).
- Look for upload features (customer uploads, ticket attachments, marketing assets) where images could be passed into ActivePDF toolkit.
Determine the exact ActivePDF toolkit version
- Check the version bundled with your application/package, installed components, or vendor-provided libraries.
- Confirm whether the toolkit is embedded as part of ActivePDF toolkit and not replaced by another image-processing component.
Apply the fix
- Upgrade ActivePDF toolkit to 8.1.0.19023 (fixed) or later.
- If you have multiple environments (dev/test/prod), upgrade in the same order and confirm functionality after each upgrade.
Temporary mitigation if upgrade is delayed
- Stop feeding untrusted images into the ActivePDF toolkit until it’s upgraded.
- If business needs image processing, consider routing uploads through a different, already-patched processing pipeline outside ActivePDF (approved by your vendor/IT), and only pass trusted/verified outputs to ActivePDF.
- Reduce exposure by limiting which image sources are accepted and by validating that images are actually images you expect (formats/content checks), while recognizing this may not fully block exploitation for memory-safety issues.
What to monitor after changes
- Check application logs for image processing errors and failed conversions during rollout.
- Monitor for unexpected process execution or unusual outbound network activity from the application host if you have endpoint monitoring in place.
Timing
- No CISA KEV listing was provided for this issue; still treat as urgent due to public exploits and the critical impact potential.

Technical context

CVE-2018-7264 involves memory-safety weaknesses (CWE-787: out-of-bounds write) in the Pictview image processing library embedded within ActivePDF toolkit through 2018.1.0.18321. The attacker’s goal is remote code execution by sending a crafted image that triggers out-of-bounds write/sign errors during processing by vulnerable applications.

Findings indicate:

Public exploit availability (2 known), meaning weaponized attack paths exist.
Fix availability: ActivePDF toolkit fixed in 8.1.0.19023.
CISA KEV: not listed.
Exploit likelihood prediction (EPSS) is not used as a decision driver here; public exploit availability takes precedence.

Practical attack vector: reachability to the ActivePDF toolkit image-processing workflow with untrusted images (no KEV reachability gate was provided in the findings, so treat exposure as dependent on your integration using this toolkit).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

12% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

21 events over 3129 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → lowepss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → lowepss band change

Affected products

activepdfcommercialaka active pdf
- activepdf toolkitMixedEnterprise Software / document-mgmt

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable