CVE-2022-24954

CRITICAL

Foxit PDF Reader < 11.1.0.52543 & Editor < 10.1.6.37749 - Stack Overflow via XFA Subform ColSpan

Title source: llm

Description

Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpan="-2"' and 'draw colSpan="1"' substrings.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_misc

https://www.foxit.com/support/security-bulletins.html

Exploit, Third Party Advisory x_refsource_misc

https://twitter.com/l33d0hyun/status/1487047927415459851

Scores

CVSS v3 9.8

EPSS 0.0090

EPSS Percentile 75.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (2)

foxit/pdf_editor < 10.1.6.37749

foxit/pdf_reader < 11.1.0.52543

Published Feb 11, 2022

Tracked Since Feb 18, 2026