CVE-2023-32664 — Type Confusion in Reader

CWE-843 — Type Confusion3 documents3 sources
Severity
7.8HIGHNVD
CNA8.8
EPSS
3.5%
top 12.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Foxit ReaderFoxit PDF Reader
Timeline
PublishedJul 19

Description

A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. User would need to open a malicious file to trigger the vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfoxit/pdf_reader12.1.2.15332
▶CVEListV5foxit/foxit_reader12.1.2.15332

🔴Vulnerability Details

2
GHSA
GHSA-xpg9-vvh4-vqjv: A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12↗2023-07-19
▶
CVEList
CVE-2023-32664: A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12↗2023-07-19
▶
CVE-2023-32664 — Type Confusion in Foxit Reader | cvebase