CVE-2021-40326 — Improper Verification of Cryptographic Signature in PDF Editor

CWE-347 — Improper Verification of Cryptographic Signature3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 80.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Foxit PDF EditorFoxit PDF ReaderFoxit Phantompdf
Timeline
PublishedAug 29

Description

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDfoxit/pdf_editor11.0 — 11.1
▶NVDfoxit/pdf_reader11.0 — 11.1
▶NVDfoxit/phantompdf< 10.1.6

🔴Vulnerability Details

2
GHSA
GHSA-2c8p-fcx5-8r73: Foxit PDF Reader before 11↗2022-08-29
▶
CVEList
CVE-2021-40326: Foxit PDF Reader before 11↗2022-08-29
▶
CVE-2021-40326 — Foxit PDF Editor vulnerability | cvebase