Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability
CVE-2023-27364
7.8HIGH
Summary
A vulnerability in Foxit PDF Editor allows for the execution of arbitrary code via malicious XLS files. The flaw is rooted in the inadequate restriction of macro-enabled documents during parsing. When a user interacts with a compromised file or visits a malicious webpage that prompts the opening of such documents, an attacker can exploit this weakness to execute code within the context of the current process. This presents a critical security risk for users, particularly those interacting with unverified documents.
Affected Version(s)
PDF Editor 12.1.0.15250
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved