Use-after-Free Vulnerability in Foxit PDF Reader
CVE-2018-3996

8HIGH

Key Information:

Vendor

Foxit
Status
Foxit PDF Reader
Vendor
CVE Published:
8 October 2018

What is CVE-2018-3996?

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, specifically in version 9.2.0.9297. This issue arises when a specially crafted PDF document causes an object in memory to be reused after it has been freed. If exploited, this could allow an attacker to execute arbitrary code with the permissions of the user. The attack requires the user to be tricked into opening the malicious PDF file. Additionally, if the browser plugin for Foxit PDF Reader is enabled, merely visiting a malicious website containing the exploit can also trigger the vulnerability.

Affected Version(s)

Foxit PDF Reader 9.2.0.9297

References

http://www.securitytracker.com/id/1041769
vdb-entryx_refsource_SECTRACK
https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.