Remote Code Execution Vulnerability in Foxit PDF Reader
CVE-2021-34975
7.8HIGH
Summary
A use-after-free vulnerability arises in the Foxit PDF Reader due to improper validation of object existence within the transitionToState method. This flaw allows remote attackers to execute arbitrary code by enticing users to visit malicious web pages or open compromised files. Successful exploitation occurs when the necessary user interaction is provided, facilitating the execution of attacker-controlled code within the context of the current process. Mitigation steps are recommended, including updating to the latest version of Foxit PDF Reader and exercising caution when opening unknown files.
Affected Version(s)
PDF Reader 11.0.1.49938
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved