CVE-2015-1282

CVE-2015-1282 describes multiple use-after-free vulnerabilities within the PDFium library's JavaScript engine, specifically in the Document::delay and Document::DoFieldDelay functions. These flaws, present in Google Chrome prior to version 44.0.2403.89 and affecting products like Debian, Google, OpenSUSE, and Red Hat, can be triggered by a specially crafted PDF document. The vulnerability has a CVSS score of 6.8, indicating a medium severity. An unauthenticated remote attacker could exploit this with medium attack complexity (AV:N/AC:M/Au:N), potentially leading to a denial of service, information disclosure, or arbitrary code execution (C:P/I:P/A:P). While not listed in CISA's KEV catalog, and with no known Metasploit or ExploitDB modules, the vulnerability has garnered some community attention with two mentions and two media articles, suggesting awareness within the security community. Its EPSS score is low, indicating a low probability of exploitation in the wild.