PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8386 Iceni CVE debrief

CVE-2016-8386 describes a high-severity heap-based buffer overflow in Iceni Argus 6.6.04. When Argus converts a PDF containing a malformed font to XML, a signedness issue can cause it to return a buffer smaller than the requested size. The subsequent write into that buffer can overflow heap memory and may lead to code execution in the context of the user running the tool. The CVE was published on 2017-02-27.

Vendor
Iceni
Product
CVE-2016-8386
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-27
Original CVE updated
2026-05-13
Advisory published
2017-02-27
Advisory updated
2026-05-13

Who should care

Organizations and users that run Iceni Argus to process PDFs, especially workflows that handle untrusted or externally supplied documents. Security teams should pay particular attention if Argus is part of automated conversion pipelines, desktop publishing workflows, or document ingestion systems.

Technical summary

NVD lists Iceni Argus 6.6.04 as vulnerable and maps the issue to CWE-787 (out-of-bounds write). The reported flaw is a heap-based buffer overflow caused by a signedness error during PDF-to-XML conversion. A malformed font in a PDF can influence size handling so that a buffer smaller than intended is selected from a linked list, and later writes overrun that heap buffer. NVD reports CVSS v3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating local execution with user interaction and potentially severe impact.

Defensive priority

High. Treat as urgent where Argus processes untrusted PDFs or is exposed in user-facing conversion workflows, because successful exploitation can affect confidentiality, integrity, and availability.

Recommended defensive actions

  • Identify whether Iceni Argus 6.6.04 is installed or embedded in any document-processing workflow.
  • Restrict or sandbox PDF conversion jobs that may receive untrusted documents.
  • Do not open or process suspicious PDFs with affected Argus deployments until remediation is confirmed.
  • Review vendor guidance and the linked third-party advisory references for any available update, workaround, or removal guidance.
  • Monitor for unexpected crashes or memory-corruption symptoms in PDF-to-XML conversion jobs.
  • Replace or isolate the affected component if no fixed version or vendor remediation is available in your environment.

Evidence notes

The description and affected-version mapping come from the supplied CVE/NVD record. NVD lists Iceni Argus 6.6.04 as vulnerable, associates the weakness with CWE-787, and provides CVSS v3.1 7.8 with user interaction required. The supplied NVD references include a SecurityFocus BID entry marked broken link and a Talos advisory/report reference.

Official resources

CVE published by the CVE program on 2017-02-27. The supplied record was last modified on 2026-05-13. No exploit code or weaponized reproduction details are included here.