CVE-2018-3958
HIGHFoxit PhantomPDF and Reader < 9.2.0.9297 - Use-After-Free via JavaScript Subject Property
Title source: llmDescription
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Subject property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
References (3)
Core 3
Core References
Patch, Vendor Advisory
https://www.foxitsoftware.com/support/security-bulletins.php
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1041769
Third Party Advisory x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628
Scores
CVSS v3
7.8
EPSS
0.0022
EPSS Percentile
44.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
Status
published
Products (2)
foxitsoftware/phantompdf
< 9.2.0.9297
foxitsoftware/reader
< 9.2.0.9297
Published
Oct 02, 2018
Tracked Since
Feb 18, 2026