CVE-2025-34106

PDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature

8.4 HighPublic exploit

A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image using the 'Convert PDF to Image' functionality. An attacker can exploit this vulnerability by tricking a user into opening a maliciously crafted PDF file, leading to arbitrary code execution under the context of the user. This vulnerability has been verified on Windows XP, 7, 8, and 10 platforms using the PDFTools.exe component.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.45%Up 0.4 points since Jul 16, 2025

What each source reports

CVE List Score used 8.4

PDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature

Record: CVE-2025-34106
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-119, CWE-120
Updated: 2026-11-02

EUVDEUVD-2025-21428 8.4

Record: EUVD-2025-21428
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8276-hmm2-6q4h 8.4

A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a...

Record: GHSA-8276-hmm2-6q4h
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-119
Updated: 2026-11-02

NVD 8.4

Record: CVE-2025-34106
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-119, CWE-120
Updated: 2026-11-02

Affected products

burnaware pdf shaper

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	PDF Shaper Buffer Overflow	2015-10-03

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-34106 is a high vulnerability (CVSS 8.4) in Burnaware Pdf Shaper, published July 15, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. No source names a fixed version.