CVE-2016-10403
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63...
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- Record
CVE-2016-10403- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- Record
CVE-2016-10403- Updated
- 2026-11-02
EUVDEUVD-2016-1585 No score
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- Record
EUVD-2016-1585- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8973-9xqm-82q8
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63...
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- Record
GHSA-8973-9xqm-82q8- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:8 |
before 51.0.2704.63-1~deb8u1, plus listed versions 41.0.2272.118-142.0.2311.135-142.0.2311.135-1~deb8u142.0.2311.135-242.0.2311.90-1 Show 45 moreShow less42.0.2311.90-1~deb8u142.0.2311.90-243.0.2357.124-143.0.2357.124-243.0.2357.124-343.0.2357.130-143.0.2357.65-143.0.2357.65-1~deb8u143.0.2357.81-144.0.2403.107-144.0.2403.107-244.0.2403.157-144.0.2403.89-144.0.2403.89-1~deb8u145.0.2454.101-145.0.2454.85-145.0.2454.85-1~deb8u146.0.2490.13-146.0.2490.71-146.0.2490.71-1~deb8u147.0.2526.111-147.0.2526.16-147.0.2526.73-147.0.2526.73-1~deb8u147.0.2526.80-147.0.2526.80-1~deb8u147.0.2526.80-247.0.2526.80-348.0.2564.116-148.0.2564.116-1~deb8u148.0.2564.23-148.0.2564.82-148.0.2564.82-1~deb8u148.0.2564.82-249.0.2623.108-149.0.2623.108-1~deb8u149.0.2623.108-249.0.2623.75-149.0.2623.75-1~deb8u149.0.2623.75-249.0.2623.87-149.0.2623.87-1~deb8u150.0.2661.75-150.0.2661.75-1~deb8u150.0.2661.75-2 |
51.0.2704.63-1~deb8u1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10403 is a high vulnerability (CVSS 8.8) in Google Chrome, published June 1, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in chromium-browser 51.0.2704.63-1~deb8u1.
References
Left out here: 2 versions. The JSON record has them.