This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA templates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11727.
2021-02-12T00:15:12.423
2024-11-21T05:21:56.997
Modified
CVSSv3.1: 7.8 (HIGH)
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
Type | Vendor | Product | Version/Range | Vulnerable? |
---|---|---|---|---|
Application | foxitsoftware | foxit_reader | ≤ 10.1.0.37527 | Yes |
Application | foxitsoftware | phantompdf | ≤ 9.7.4.29600 | Yes |
Application | foxitsoftware | phantompdf | ≤ 10.1.0.37527 | Yes |
Operating System | microsoft | windows | - | No |