CVE-2018-9954: Use After Free
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA Button elements. When setting the y attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5529.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the vulnerability?
Exposure requires a user to visit a malicious page or open a malicious file. Exploitation is remote and requires no attacker privileges, but it does require user interaction.
What is the impact if exploitation succeeds?
Successful exploitation can execute arbitrary code in the context of the current Foxit Reader or PhantomPDF process. The listed CVSS vector rates confidentiality, integrity, and availability impact as high.
Which products and versions are identified as affected?
The affected Foxit Reader installation identified in the available data is version 9.0.1.1049. Foxit Reader and Foxit PhantomPDF are listed as affected software, but no affected PhantomPDF version is provided.