Information Disclosure Vulnerability in Foxit Studio Photo by Foxit Software

CVE-2020-27855

Summary

The vulnerability enables remote attackers to disclose sensitive information from affected installations of Foxit Studio Photo 3.6.6.922. Exploitation requires user interaction, as the victim must visit a malicious page or open a crafted file. The vulnerability arises from improper validation of user-supplied data during the parsing of SR2 files, leading to a read past the end of an allocated structure. Attackers can exploit this flaw in tandem with other vulnerabilities to potentially execute arbitrary code within the context of the current process.

References