CVE-2018-3942

HIGH

Foxit PhantomPDF and Reader < 9.2.0.9297 - Use-After-Free via JavaScript Engine

Title source: llm
STIX 2.1

Description

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041769
Exploit, Third Party Advisory x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0609

Scores

CVSS v3 8.8
EPSS 0.0071
EPSS Percentile 72.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (2)
foxitsoftware/phantompdf < 9.2.0.9297
foxitsoftware/reader < 9.2.0.9297
Published Oct 08, 2018
Tracked Since Feb 18, 2026