Lucene search

K
prionPRIOn knowledge basePRION:CVE-2022-38097
HistoryNov 21, 2022 - 4:15 p.m.

Design/Logic Flaw

2022-11-2116:15:00
PRIOn knowledge base
www.prio-n.com
2
use-after-free
javascript engine
foxit software
pdf reader
version 12.0.1.12430
annotation objects
memory reuse
arbitrary code execution
attacker
malicious file
browser plugin extension

EPSS

0.001

Percentile

28.5%

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.

CPENameOperatorVersion
pdf_readereq12.0.1.12430

EPSS

0.001

Percentile

28.5%