CVE-2020-13570

HIGH

Foxit Reader 10.1.0.37527 - Use-After-Free in JavaScript Engine

Title source: llm
STIX 2.1

Description

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger the reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1181

Scores

CVSS v3 8.8
EPSS 0.0529
EPSS Percentile 90.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (1)
foxitsoftware/foxit_reader 10.1.0.37527
Published Dec 22, 2020
Tracked Since Feb 18, 2026