CVE-2018-10303
HIGHFoxit Reader and PhantomPDF < 9.1 - Remote Code Execution via Use-After-Free
Title source: llmDescription
A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-y0nqfutlf3.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://srcincite.io/advisories/src-2018-0020/
Vendor Advisory x_refsource_confirm
https://www.foxitsoftware.com/support/security-bulletins.php
Scores
CVSS v3
8.8
EPSS
0.0059
EPSS Percentile
69.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
Status
published
Products (2)
foxitsoftware/foxit_reader
< 9.1
foxitsoftware/phantompdf
< 9.1
Published
Apr 23, 2018
Tracked Since
Feb 18, 2026