Use-After-Free Vulnerability in Foxit PDF Reader Software
CVE-2018-3942

8HIGH

Key Information:

Vendor
Foxit
Status
Foxit PDF Reader
Vendor
CVE Published:
8 October 2018

Summary

An exploitable use-after-free vulnerability is present in the JavaScript engine of Foxit PDF Reader. This flaw arises when a specific PDF is manipulated to interact with a previously freed object in memory, leading to the potential execution of arbitrary code. An attacker can leverage this vulnerability by deceiving the user into opening a specially crafted PDF document. Ensuring users are aware of the risks associated with untrusted files is essential to mitigating this threat.

Affected Version(s)

Foxit PDF Reader 9.1.0.5096

References

http://www.securitytracker.com/id/1041769
vdb-entryx_refsource_SECTRACK
https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.