CVE-2020-26540 — Improper Verification of Cryptographic Signature in Foxit Reader

CWE-347 — Improper Verification of Cryptographic SignatureCWE-94 — Code Injection3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 99.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Foxitsoftware Foxit ReaderFoxitsoftware Phantompdf
Timeline
PublishedOct 2
Latest updateMay 24

Description

An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened Runtime protection mechanism is not applied to code signing, code injection (or an information leak) can occur.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: www.foxitsoftware.com ↗Patch: www.foxitsoftware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p8p9-354j-7mhr: An issue was discovered in Foxit Reader and PhantomPDF before 4↗2022-05-24
▶
CVEList
CVE-2020-26540: An issue was discovered in Foxit Reader and PhantomPDF before 4↗2020-10-02
▶
CVE-2020-26540 — Foxit Reader vulnerability | cvebase