CVE-2020-13557

HIGH

Foxit Reader 10.1.0.37527 - Use-After-Free in JavaScript Engine

Title source: llm
STIX 2.1

Description

A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1171

Scores

CVSS v3 8.8
EPSS 0.1403
EPSS Percentile 94.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (1)
foxitsoftware/foxit_reader 10.1.0.37527
Published Dec 22, 2020
Tracked Since Feb 18, 2026