CVE-2023-41257
First published: Mon Nov 27 2023(Updated: )
A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Foxit Reader | =12.1.3.15356 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-41257.
What is the severity of CVE-2023-41257?
The severity of CVE-2023-41257 is high with a severity value of 8.8.
Which software is affected by CVE-2023-41257?
Foxit Reader version 12.1.3.15356 is affected by CVE-2023-41257.
What is the description of CVE-2023-41257?
CVE-2023-41257 is a type confusion vulnerability in Foxit Reader that can lead to memory corruption and arbitrary code execution.
Are there any references available for CVE-2023-41257?
Yes, you can find references for CVE-2023-41257 at the following links: [Reference 1](https://talosintelligence.com/vulnerability_reports/TALOS-2023-1838), [Reference 2](https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1838).
- collector/mitre-cve
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/foxitsoftware
- canonical/foxit reader
- version/foxit reader/12.1.3.15356