CVE-2018-3939

HIGH

Foxit Reader and PhantomPDF < 9.1.0.5096 - Use-After-Free in JavaScript Engine

Title source: llm
STIX 2.1

Description

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

References (2)

Core 2
Core References
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0606

Scores

CVSS v3 8.8
EPSS 0.3929
EPSS Percentile 97.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (2)
foxitsoftware/foxit_reader < 9.1.0.5096
foxitsoftware/phantompdf < 9.1.0.5096
Published Aug 01, 2018
Tracked Since Feb 18, 2026