CVE-2018-3850: Use After Free

Published Apr 23, 2018

Updated

An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If a browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Affected Software

1 affected component

Foxit PDF Reader=9.0.1.1049

Event History

Apr 23, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3850?

CVE-2018-3850 has been assigned a high severity rating due to its potential for arbitrary code execution.

How do I fix CVE-2018-3850?

To mitigate CVE-2018-3850, users should upgrade to the latest version of Foxit PDF Reader available after 9.0.1.1049.

What causes the vulnerability in CVE-2018-3850?

CVE-2018-3850 is triggered by a use-after-free error in the JavaScript engine when processing specially crafted PDF documents.

Who is affected by CVE-2018-3850?

Users of Foxit PDF Reader version 9.0.1.1049 are specifically affected by CVE-2018-3850.

Can CVE-2018-3850 be exploited remotely?

Yes, CVE-2018-3850 can be exploited remotely if an attacker tricks a user into opening a malicious PDF document.