CVE-2020-35931

HIGH

Foxit Reader and PhantomPDF < 10.1.1 - Certified PDF Spoofing via Evil Annotation Attack

Title source: llm
STIX 2.1

Description

An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and before 4.1.1 on macOS). An attacker can spoof a certified PDF document via an Evil Annotation Attack because the products fail to consider a null value for a Subtype entry of the Annotation dictionary, in an incremental update.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://www.foxitsoftware.com/support/security-bulletins.html

Scores

CVSS v3 7.8
EPSS 0.0010
EPSS Percentile 27.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-754
Status published
Products (2)
foxitsoftware/foxit_reader < 10.1.1
foxitsoftware/phantompdf < 9.7.5
Published Dec 31, 2020
Tracked Since Feb 18, 2026