CVE-2018-3944
HIGHFoxit PhantomPDF and Reader < 9.2.0.9297 - Use-After-Free in JavaScript Engine
Title source: llmDescription
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
References (3)
Core 3
Core References
Patch, Vendor Advisory
https://www.foxitsoftware.com/support/security-bulletins.php
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1041769
Third Party Advisory x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0611
Scores
CVSS v3
8.8
EPSS
0.0071
EPSS Percentile
72.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
Status
published
Products (2)
foxitsoftware/phantompdf
< 9.2.0.9297
foxitsoftware/reader
< 9.2.0.9297
Published
Oct 02, 2018
Tracked Since
Feb 18, 2026