Foxit PDF Reader UAF CVE-2021-34976: Remote Info Disclosure
CVE-2021-34976 Published on May 7, 2024

Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14659.

Vendor Advisory NVD

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2021-34976 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2021-34976

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-34976 are published in these products:

Foxit Pdf Editor
 
Foxit Pdf Reader
 
Foxit Software Foxit Reader
 

Affected Versions

Foxit PDF Reader: foxit pdf_reader:

Exploit Probability

EPSS
0.67%
Percentile
70.98%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.