Remote Code Execution Vulnerability in Foxit Reader SDK by Foxit Software
CVE-2018-19446

7.8HIGH

Key Information:

Vendor

Foxit
Status
Foxit PDF Sdk Activex
Vendor
CVE Published:
17 June 2019

What is CVE-2018-19446?

In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, a vulnerable JavaScript API (Doc.createDataObject) can be exploited through specially crafted PDF files, leading to unauthorized file write actions. This could allow an attacker to execute arbitrary code on the target system, posing a significant security risk to users of the affected product.

References

https://www.foxitsoftware.com/support/security-bulletins.php
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.