Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability
CVE-2023-27364

7.8HIGH

Key Information:

Vendor
Foxit
Vendor
CVE Published:
3 May 2024

Summary

A vulnerability in Foxit PDF Editor allows for the execution of arbitrary code via malicious XLS files. The flaw is rooted in the inadequate restriction of macro-enabled documents during parsing. When a user interacts with a compromised file or visits a malicious webpage that prompts the opening of such documents, an attacker can exploit this weakness to execute code within the context of the current process. This presents a critical security risk for users, particularly those interacting with unverified documents.

Affected Version(s)

PDF Editor 12.1.0.15250

References

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.