Remote Code Execution Vulnerability in Foxit Reader SDK by Foxit Software
CVE-2018-19446
7.8HIGH
Summary
In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, a vulnerable JavaScript API (Doc.createDataObject) can be exploited through specially crafted PDF files, leading to unauthorized file write actions. This could allow an attacker to execute arbitrary code on the target system, posing a significant security risk to users of the affected product.
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved