CVE-2018-3966: Use After Free
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3966?
CVE-2018-3966 is considered to have a critical severity due to its potential for arbitrary code execution.
How do I fix CVE-2018-3966?
To fix CVE-2018-3966, update Foxit PDF Reader to version 9.2.0.9297 or later.
What versions are affected by CVE-2018-3966?
CVE-2018-3966 affects Foxit PDF Reader versions up to and including 9.2.0.9297.
What type of vulnerability is CVE-2018-3966?
CVE-2018-3966 is a use-after-free vulnerability that can lead to security breaches.
What can an attacker do with CVE-2018-3966?
An attacker exploiting CVE-2018-3966 can execute arbitrary code on the user's system through a specially crafted PDF.