CVE-2020-26535 — Out-of-bounds Write in Foxit Reader

CWE-787 — Out-of-bounds Write3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.0%
top 92.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Foxitsoftware Foxit ReaderFoxitsoftware Phantompdf
Timeline
PublishedOct 2
Latest updateMay 24

Description

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. If TslAlloc attempts to allocate thread local storage but obtains an unacceptable index value, V8 throws an exception that leads to a write access violation (and read access violation).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

Patches

Patch: www.foxitsoftware.com ↗Patch: www.foxitsoftware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-j4q4-v7ww-5hxm: An issue was discovered in Foxit Reader and PhantomPDF before 10↗2022-05-24
▶
CVEList
CVE-2020-26535: An issue was discovered in Foxit Reader and PhantomPDF before 10↗2020-10-02
▶
CVE-2020-26535 — Out-of-bounds Write in Foxit Reader | cvebase