Foxit Software

Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability

CVE-2024-12751 - December 30, 2024

Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25344.

Out-of-bounds Read

Foxit PDF Reader AcroForm Memory Corruption RCE

CVE-2024-12752 - December 30, 2024

Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25345.

Buffer Overflow

Foxit PDF Reader Installer Local Privilege Escalation via Junction Creation

CVE-2024-12753 - December 30, 2024

Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. By creating a junction, an attacker can abuse the installer process to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25408.

insecure temporary file

Foxit Reader 3D Page Object Use-After-Free Vulnerability

CVE-2024-47810 8.8 - High - December 18, 2024

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Foxit Reader Use-After-Free Vulnerability in CBF_Widget Object

CVE-2024-49576 8.8 - High - December 18, 2024

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations

CVE-2023-32616 8.8 - High - November 27, 2023

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension

CVE-2023-35985 8.8 - High - November 27, 2023

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled.

Externally Controlled Reference to a Resource in Another Sphere

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field

CVE-2023-38573 8.8 - High - November 27, 2023

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356

CVE-2023-39542 8.8 - High - November 27, 2023

A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to remote code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Externally Controlled Reference to a Resource in Another Sphere

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters

CVE-2023-40194 8.8 - High - November 27, 2023

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Externally Controlled Reference to a Resource in Another Sphere

A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties

CVE-2023-41257 8.8 - High - November 27, 2023

A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Object Type Confusion

An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569

CVE-2022-43310 7.8 - High - November 09, 2022

An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when searching for DLL libraries without specifying an absolute path.

DLL preloading

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1

CVE-2021-38564 9.1 - Critical - August 11, 2021

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand.

Out-of-bounds Read

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1

CVE-2021-38565 7.5 - High - August 11, 2021

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm.

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1

CVE-2021-38566 7.5 - High - August 11, 2021

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML nodes.

Stack Exhaustion

An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS

CVE-2021-38567 7.5 - High - August 11, 2021

An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS. It mishandles missing dictionary entries, leading to a NULL pointer dereference, aka CNVD-C-2021-95204.

NULL Pointer Dereference

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1

CVE-2021-38563 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It mishandles situations in which an array size (derived from a /Size entry) is smaller than the maximum indirect object number, and thus there is an attempted incorrect array access (leading to a NULL pointer dereference, or out-of-bounds read or write).

out-of-bounds array index

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4

CVE-2021-38568 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format.

Memory Corruption

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4

CVE-2021-38569 7.5 - High - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects.

Stack Exhaustion

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4

CVE-2021-38573 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4

CVE-2021-38574 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.

SQL Injection

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4

CVE-2021-38570 9.1 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.

insecure temporary file

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4

CVE-2021-38572 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4

CVE-2021-33794 9.1 - Critical - August 11, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key during XFA form interaction.

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write

CVE-2021-33793 9.8 - Critical - August 11, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conversion.

Memory Corruption

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.3.37598

CVE-2021-21831 8.8 - High - August 05, 2021

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.4.37651

CVE-2021-21870 8.8 - High - August 05, 2021

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.4.37651. A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled.

Dangling pointer

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 11.0.0.49893

CVE-2021-21893 8.8 - High - August 05, 2021

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 11.0.0.49893. A specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write

CVE-2021-33792 7.8 - High - July 09, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.

Memory Corruption

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures

CVE-2021-33795 5.5 - Medium - July 09, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled.

Improper Handling of Exceptional Conditions

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.3.37598

CVE-2021-21822 8.8 - High - May 10, 2021

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled.

Dangling pointer

In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory

CVE-2020-13548 8.8 - High - February 10, 2021

In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922

CVE-2020-17426 7.8 - High - February 09, 2021

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11230.

Buffer Overflow

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition

CVE-2018-20316 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode.

Memory Corruption

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition

CVE-2018-20315 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow or an out-of-bounds read.

Race Condition

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition

CVE-2018-20314 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-based buffer overflow or an out-of-bounds read.

Memory Corruption

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition

CVE-2018-20313 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.

Memory Corruption

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition

CVE-2018-20309 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read.

Memory Corruption

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition

CVE-2018-20310 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.

Memory Corruption

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition

CVE-2018-20311 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.

Memory Corruption

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition

CVE-2018-20312 8.1 - High - January 07, 2021

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode.

Memory Corruption

A type confusion vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527

CVE-2020-13547 8.8 - High - December 22, 2020

A type confusion vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger an improper use of an object, resulting in memory corruption and arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Memory Corruption

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527

CVE-2020-13557 8.8 - High - December 22, 2020

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527

CVE-2020-13560 8.8 - High - December 22, 2020

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.0.37527

CVE-2020-13570 8.8 - High - December 22, 2020

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger the reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier

CVE-2020-28203 5.5 - Medium - December 15, 2020

An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier. There is a null pointer access/dereference while opening a crafted PDF file, leading the application to crash (denial of service).

NULL Pointer Dereference

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API

CVE-2020-14425 7.8 - High - November 02, 2020

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.

An issue was discovered in Foxit Reader and PhantomPDF before 10.1

CVE-2020-26537 9.8 - Critical - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. In a certain Shading calculation, the number of outputs is unequal to the number of color components in a color space. This causes an out-of-bounds write.

Memory Corruption

An issue was discovered in Foxit Reader and PhantomPDF before 10.1

CVE-2020-26536 5.5 - Medium - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is a NULL pointer dereference via a crafted PDF document.

NULL Pointer Dereference

An issue was discovered in Foxit Reader and PhantomPDF before 10.1

CVE-2020-26534 9.8 - Critical - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is an Opt object use-after-free related to Field::ClearItems and Field::DeleteOptions, during AcroForm JavaScript execution.

Dangling pointer