CVE-2018-3961

HIGH

Foxit PhantomPDF and Reader < 9.2.0.9297 - Use-After-Free via JavaScript Creator Property

Title source: llm
STIX 2.1

Description

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Creator property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0694
EPSS Percentile 91.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (2)
foxitsoftware/phantompdf < 9.2.0.9297
foxitsoftware/reader < 9.2.0.9297
Published Oct 02, 2018
Tracked Since Feb 18, 2026