CVE-2018-3924: Use After Free
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3924?
CVE-2018-3924 has a high severity rating due to its ability to lead to arbitrary code execution.
How do I fix CVE-2018-3924?
To fix CVE-2018-3924, you should update Foxit Reader or Foxit PhantomPDF to a version beyond 9.1.5096.
What platforms are affected by CVE-2018-3924?
CVE-2018-3924 affects Foxit Reader and Foxit PhantomPDF on Windows platforms.
Can CVE-2018-3924 be exploited remotely?
Yes, CVE-2018-3924 can be exploited remotely if a user opens a specially crafted PDF document.
Who is the vendor for CVE-2018-3924?
The vendor for CVE-2018-3924 is Foxit Software, which develops Foxit Reader and PhantomPDF.