CVE-2018-19445

HIGH

Foxit Reader SDK (ActiveX) Pro 5.4.0.1031 - Command Injection

Title source: llm
STIX 2.1

Description

A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://www.foxitsoftware.com/support/security-bulletins.php

Scores

CVSS v3 7.8
EPSS 0.0092
EPSS Percentile 76.2%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-77
Status published
Products (1)
foxitsoftware/foxit_pdf_sdk_activex < 5.5.0
Published Jun 17, 2019
Tracked Since Feb 18, 2026