CVE-2018-3924

HIGH

Foxit Reader and PhantomPDF < 9.1.0.5096 - Use-After-Free via JavaScript Engine

Title source: llm
STIX 2.1

Description

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041353
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0588

Scores

CVSS v3 8.8
EPSS 0.4834
EPSS Percentile 97.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (2)
foxitsoftware/foxit_reader < 9.1.0.5096
foxitsoftware/phantompdf < 9.1.0.5096
Published Aug 01, 2018
Tracked Since Feb 18, 2026