Use After Free Vulnerability in Foxit Reader SDK ActiveX
CVE-2018-19444

7.8HIGH

Key Information:

Vendor
Foxit
Status
Foxit PDF Sdk Activex
Vendor
CVE Published:
17 June 2019

Summary

A use after free vulnerability exists in the Validate action of the TextBox field within the IReader_ContentProvider component of Foxit Reader SDK (ActiveX) Professional 5.4.0.1031. It can be triggered when specially crafted PDF files are processed. An attacker could exploit this flaw to execute arbitrary code remotely, leading to significant security risks for affected systems. This vulnerability is distinct from CVE-2018-19452, showcasing different memory handling issues and requiring unique JavaScript payloads for successful exploitation.

References

https://www.foxitsoftware.com/support/security-bulletins.php
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.