Evil Annotation Attack in Foxit Reader and PhantomPDF Leading to Document Spoofing

CVE-2020-35931

Summary

A vulnerability exists in Foxit Reader and PhantomPDF, where an attacker can exploit a flaw in how the software handles Annotation dictionaries. This vulnerability allows an attacker to craft a certified PDF document with malicious annotations, thus facilitating the spoofing of legitimate documents. This attack is possible because the software does not adequately handle null values in Subtype entries during incremental updates, making it critical for users to ensure their software is updated to avoid exploitation.

References