Foxit PDF Editor < 13.2.6 / 14.0.6 / 2026.1.3 Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335431);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/14");

  script_cve_id("CVE-2026-18622");

  script_name(english:"Foxit PDF Editor < 13.2.6 / 14.0.6 / 2026.1.3 Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"A PDF toolkit installed on the remote Windows host is affected by a vulnerability");
  script_set_attribute(attribute:"description", value:
"According to its version, the Foxit PDF Editor application (previously named Foxit PhantomPDF) installed on the remote
Windows host is prior to 2026.1.3/14.0.6/13.2.6. It is, therefore affected by vulnerability:

  - Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified,
    including alterations to appearance, coordinates, or field duplication. This may mislead users into
    trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of
    signatures. (CVE-2026-18622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a27a3e57");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Foxit PDF Editor version 13.2.6 / 14.0.6 / 2026.1.3 or later");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-18622");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("foxit_phantom_installed.nasl");
  script_require_keys("installed_sw/FoxitPhantomPDF", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'FoxitPhantomPDF', win_local:TRUE);

var constraints = [
  { 'max_version' : '13.2.5.24109', 'fixed_version' : '13.2.6', 'fixed_display' : '2026.1.3/14.0.6/13.2.6' },
  { 'min_version' : '14.0', 'max_version' : '14.0.5.33580', 'fixed_version' : '14.0.6', 'fixed_display' : '2026.1.3/14.0.6' },
  { 'min_version' : '2023.0', 'max_version' : '2023.3.0.23028', 'fixed_version' : '2026.1.3' },
  { 'min_version' : '2024.0', 'max_version' : '2024.4.1.27687', 'fixed_version' : '2026.1.3' },
  { 'min_version' : '2025.0', 'max_version' : '2025.3.0.35737', 'fixed_version' : '2026.1.3' },
  { 'min_version' : '2026.0', 'max_version' : '2026.1.2.36540', 'fixed_version' : '2026.1.3' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);