CVE-2021-27271 — Out-of-bounds Read in Foxit Reader

CWE-125 — Out-of-bounds ReadCWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-787 — Out-of-bounds Write3 documents3 sources
Severity
7.8HIGHNVD
EPSS
3.1%
top 13.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Foxitsoftware Foxit ReaderFoxitsoftware PhantompdfFoxit Phantompdf
Timeline
PublishedMar 30
Latest updateMay 24

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in an out-of-bounds read condition. An attacker can leverage th…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDfoxitsoftware/phantompdf10.1.0.37527
▶NVDfoxitsoftware/foxit_reader10.1.0.37527
▶CVEListV5foxit/phantompdf10.1.0.37527

🔴Vulnerability Details

2
GHSA
GHSA-3m69-935c-w2hj: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10↗2022-05-24
▶
CVEList
CVE-2021-27271: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10↗2021-03-30
▶
CVE-2021-27271 — Out-of-bounds Read in Foxit Reader | cvebase