CVE-2018-19448

HIGH

Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 - RCE

Title source: llm
STIX 2.1

Description

In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader_ContentProvider::GetDocEventHandler occurs when embedding the control into Office documents. By opening a specially crafted document, an attacker can trigger an out of bounds write condition, possibly leveraging this to gain remote code execution.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://www.foxitsoftware.com/support/security-bulletins.php

Scores

CVSS v3 7.8
EPSS 0.0036
EPSS Percentile 58.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
foxitsoftware/foxit_pdf_sdk_activex < 5.5.0
Published Jun 17, 2019
Tracked Since Feb 18, 2026