CVE-2018-3939 — Use After Free in Foxit Reader

CWE-416 — Use After Free3 documents3 sources
Severity
8.8HIGHNVD
EPSS
39.3%
top 2.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Foxitsoftware Foxit ReaderFoxitsoftware PhantompdfFoxit
Timeline
PublishedAug 1
Latest updateMay 13

Description

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDfoxitsoftware/phantompdf9.1.0.5096
▶CVEListV5foxit/foxitFoxit Software Foxit PDF Reader 9.1.0.5096

Patches

Patch: www.foxitsoftware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p7wx-vpq6-4ggv: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9↗2022-05-13
▶
CVEList
CVE-2018-3939: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9↗2018-08-01
▶
CVE-2018-3939 — Use After Free in Foxit Reader | cvebase