CVE-2018-14282

CVE-2018-14282 affects Foxit Reader prior to 9.2.0.9097. The vulnerability is a FlateDecode stream handling issue caused by an uninitialized pointer, enabling remote code execution under the current process when a user opens a malicious file or visits a malicious page. Exploitation requires user ...

CVE-2018-14293

CVE-2018-14293 affects Foxit Reader 9.1.0.5096 and earlier, where parsing of PDF documents can trigger a use-after-free in the PDF handling code, allowing remote code execution when a user opens a malicious file or visits a malicious page. The vulnerability requires user interaction and executes ...

CVE-2018-14297

CVE-2018-14297 affects Foxit Reader (and Foxit PhantomPDF in some listings). The vulnerability is a use-after-free in the processing of FreeText annotations, where manipulating a document’s elements can cause a freed pointer to be reused, enabling remote code execution. Exploitation requires user...

CVE-2018-14301

Foxit Reader is affected by a Sound annotations use-after-free remote code execution vulnerability (CVE-2018-14301). Exploitation requires user interaction (visiting a malicious page or opening a crafted file) and can lead to arbitrary code execution in the context of the current process. The fla...

CVE-2018-17643

CVE-2018-17643 affects Foxit Reader 9.2.0.9297 on Windows. The vulnerability stems from the TimeField editValue handling, caused by not validating the existence of an object before performing operations, effectively a use-after-free scenario. This allows remote code execution in the context of th...

CVE-2018-17651

Foxit Reader 9.2.0.9297 contains a use-after-free/invalid object access flaw in the TimeField getItemState handler, where code executes without validating the existence of the object. This can allow remote code execution when a user opens a malicious file or visits a crafted page, as described by...

CVE-2018-17661

CVE-2018-17661 affects Foxit Reader 9.2.0.9297 and earlier on Windows. The flaw is in the handling of the messageBox method of the Host object, stemming from not validating the existence of an object before performing operations, enabling remote code execution. Exploitation requires user interact...

CVE-2018-17668

CVE-2018-17668 affects Foxit Reader 9.2.0.9297 and earlier. The flaw is in the handling of the removeAttribute method of an XFA object, caused by not validating the existence of the object before performing operations. This can allow remote code execution in the context of the current process and...

CVE-2018-17679

Foxit Reader 9.2.0.9297 and earlier versions are affected by CVE-2018-17679, a PDF parsing vulnerability that allows remote code execution via a use-after-free in document element handling. The flaw can be triggered when a user opens a malicious file or visits a malicious page, enabling code exec...

CVE-2018-17690

The CVE-2018-17690 vulnerability affects Foxit PhantomPDF (Windows) 9.2.0.9297 and earlier, where the rect property handling of a Link object can lead to remote code execution. The flaw stems from not validating the existence of an object before performing operations, enabling an attacker to exec...

CVE-2018-5679

CVE-2018-5679 affects Foxit Reader and Foxit PhantomPDF prior to 9.1. The flaw is in processing of PDF files with embedded u3d images due to insufficient validation, causing a read past end of an allocated object and enabling arbitrary code execution in the current process. The issue is exploitab...

CVE-2018-9953

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9953. The vulnerability lies in the XFA resolveNodes method of Button elements, where code executes without validating the existence of an object before performing operations. This allows remote code execution with the current process context and re...

CVE-2018-9976

CVE-2018-9976 affects Foxit Reader 9.0.0.29935. The vulnerability is an out-of-bounds read during parsing of Texture objects in U3D files caused by insufficient validation of user-supplied data, leading to potential disclosure of sensitive information. It requires user interaction (visiting a mal...

CVE-2019-20815

Foxit PhantomPDF prior to 8.3.12 has a vulnerability where stack consumption can occur via nested function calls during XML parsing, potentially leading to a crash. Affected product: Foxit PhantomPDF (before 8.3.12). Root cause: stack exhaustion in XML parsing, as described in CVE-2019-20815. Imp...

CVE-2019-20826

The CVE-2019-20826 issue affects Foxit PhantomPDF for Mac (3.3) and Foxit Reader for Mac prior to 3.3. The root cause is a NULL pointer dereference in the affected code path. Public descriptions in the connected sources only confirm the existence and nature of the vulnerability; they do not provi...

CVE-2019-6731

Foxit PhantomPDF (and Foxit Reader/PhantomPDF family cited in related records) contains an HTML-to-PDF conversion flaw in which insufficient validation of user-supplied data can cause a read past the end of an allocated object, enabling remote code execution. The vulnerability requires user inter...

CVE-2020-26534

CVE-2020-26534 affects Foxit Reader and PhantomPDF (pre-10.1). The issue is a use-after-free in an Opt object related to Field::ClearItems and Field::DeleteOptions during AcroForm JavaScript execution. Connected sources describe a resource management/use-after-free vulnerability that could crash ...

CVE-2021-33794

CVE-2021-33794 affects Foxit Reader and PhantomPDF before 10.1.4. The issue arises from mishandling the Tab key during XFA form interactions, leading to information disclosure or an application crash. Reported across multiple sources (NVD, Red Hat, CVE catalogs, and regional bulletins) with impac...

CVE-2017-8455

Foxit Reader and Foxit PhantomPDF (prior to 8.2.1) are affected by an out-of-bounds read triggered by a crafted font in a PDF, potentially revealing sensitive data or allowing arbitrary code execution. Impact is remote code execution or information disclosure in the context of the vulnerable proc...

CVE-2018-10476

Foxit Reader 9.0.0.29935 is affected by an information-disclosure vulnerability in the U3D Model Node parsing. The issue stems from improper validation of user-supplied data, causing a read past the end of an allocated structure (out-of-bounds read). An attacker can leverage this by convincing a ...

CVE-2018-10487

Foxit Reader 9.0.0.29935 is affected by CVE-2018-10487 due to an out-of-bounds read while parsing U3D files embedded in PDFs. The flaw stems from improper validation of user-supplied data, allowing a read past the end of an allocated object and resulting in information disclosure. Exploitation re...

CVE-2018-14241

CVE-2018-14241 affects Foxit Reader (9.0.1.1049) and is a type-confusion/remote code execution flaw in the addAnnot method. Exploitation requires user interaction (the target visits a malicious page or opens a malicious file); an attacker can trigger the type confusion via JavaScript to execute c...

CVE-2018-14245

CVE-2018-14245 affects Foxit Reader (e.g., version 9.0.1.1049) and is caused by a type confusion in the closeDoc method. An attacker can trigger remote code execution by convincing a user to open a malicious page or file, with user interaction required. Documented advisories (ZDI-18-705 and relat...

CVE-2018-14269

The CVE-2018-14269 issue is a type confusion vulnerability in Foxit Reader’s print method that allows remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file) and JavaScript actions trigger the fault, executing code in the current proce...

CVE-2018-16295

Summary (CVE-2018-16295): A use-after-free in Foxit Reader/PhantomPDF JavaScript engine (versions before 9.3) can be triggered by a specially crafted PDF, leading to arbitrary code execution. The attacker must persuade the user to open the malicious PDF; if a browser plugin is enabled, visiting a...

CVE-2018-17611

CVE-2018-17611 affects Foxit PhantomPDF and Foxit Reader prior to 9.3. The issue is a use-after-free related to mishandling properties of Annotation objects, with remote code execution or denial of service as described by NVD. The provided connected documents corroborate the affected products and...

CVE-2018-17620

CVE-2018-17620 affects Foxit Reader 9.0.1.5096 on Windows. The vulnerability stems from flawed handling of Calculate events where the software fails to validate the existence of an object before performing operations, enabling remote code execution in the context of the current process. User inte...

CVE-2018-17628

Foxit Reader (Windows) 9.2.0.9297 and earlier versions are affected by CVE-2018-17628. The flaw occurs in the XFA setInterval method due to not validating the existence of an object before performing operations, enabling remote code execution when a user opens a malicious file or visits a crafted...

CVE-2018-17637

Foxit Reader (Windows) vulnerable: Foxit Reader 9.2.0.9297 and earlier exposes a flaw in loadXML handling within the XFA object, where the code fails to validate the existence of an object before performing operations. This results in a use-after-free/memory misreference type condition that can a...

CVE-2018-17654

Foxit Reader on Windows (versions up to 9.2.0.9297) is affected by a vulnerability in the XFA Form Model insertInstance handling. The flaw is a use-after-free due to lack of validating object existence before operations, enabling remote code execution if a user opens a malicious file or visits a ...

CVE-2018-17655

CVE-2018-17655 affects Foxit Reader (Windows) 9.2.0.9297 and earlier, with multiple sources confirming a moveInstance handling flaw in Form objects. The root cause is the failure to validate object existence before performing operations, enabling remote code execution. Attack requires user intera...

CVE-2018-17660

CVE-2018-17660 affects Foxit Reader 9.2.0.9297 on Windows. The flaw resides in the resetData method of a Host object, failing to validate the existence of an object before performing operations, which can allow an attacker to execute arbitrary code in the current process. The vulnerability requir...

CVE-2018-17680

CVE-2018-17680 affects Foxit Reader 9.2.0.9297 (Windows). The vulnerability is in the handling of the style property of a Field object, due to missing validation before operations, leading to use-after-free and remote code execution. Exploitation requires user interaction (visiting a malicious pa...

CVE-2018-21238

CVE-2018-21238 affects Foxit PhantomPDF up to version 8.3.7, where a call involving ArrayBuffer(0xfffffffe) enables memory consumption. The connected documents confirm the vulnerability but do not provide concrete details on root cause, affected components beyond the product/version line, exploit...

CVE-2018-7406

CVE-2018-7406 affects Foxit Reader before 9.1 and Foxit PhantomPDF before 9.1. The issue is in the PDF u3d image handling, due to insufficient validation of user-supplied data, causing an array-indexing issue that can lead to remote code execution. Exploitation requires user interaction (visiting...

CVE-2018-9936

Foxit Reader 9.0.0.29935 is affected by a vulnerability in the parsing of XFA field elements that causes a type confusion condition. The issue allows remote code execution under the current process context and requires user interaction (visiting a malicious page or opening a malicious file). This...

CVE-2018-9960

CVE-2018-9960 affects Foxit Reader 9.0.1.1049. The vulnerability stems from the parsing of the textColor Field attribute where the code fails to validate the existence of an object before performing operations, allowing remote code execution under the current process. Exploitation requires user i...

CVE-2018-9973

CVE-2018-9973 affects Foxit Reader 9.0.1.1049. The flaw is an out-of-bounds read during ePub file parsing caused by insufficient validation of input data, which can lead to sensitive information disclosure and, in combination with other vulnerabilities, arbitrary code execution in the affected pr...

CVE-2019-20835

Foxit Reader and PhantomPDF prior to 9.5 are affected by a homograph mishandling issue. CVSSv3.1 base score 4.3 (NETWORK attack, USER INTERACTION required; I=LOW) per provided records. No explicit root cause, exploit details, or remediation are stated in the documents; no detailed impact beyond t...

CVE-2019-6735

CVE-2019-6735 affects Foxit Reader. A vulnerability in PDF file processing causes an out-of-bounds read due to lack of proper validation of user-supplied data, potentially disclosing sensitive information. Exploitation requires user interaction (visiting a malicious page or opening a malicious fi...

CVE-2021-31445

CVE-2021-31445 describes a buffer/read-out-of-bounds in Foxit Reader 10.1.1.37576 related to handling of U3D objects in PDFs. The flaw arises from insufficient validation of user-supplied data, enabling a read past the end of an allocated object. An attacker could leverage this, in conjunction wi...

CVE-2021-31446

Foxit Reader 10.1.1.37576 is affected by CVE-2021-31446 due to an out-of-bounds read in the handling of U3D objects embedded in PDF files. The flaw arises from insufficient validation of data, enabling a read past the end of an allocated object. Exploitation requires user interaction (the target ...

CVE-2018-10475

Foxit Reader 9.0.0.29935 is affected by an out-of-bounds read in the parsing of U3D Light Node structures. The flaw, caused by insufficient validation, can disclose sensitive information on the current system. Exploitation requires user interaction (visiting a malicious page or opening a maliciou...

CVE-2018-14263

Foxit Reader (and Foxit PhantomPDF) are affected by a getVersionID type-confusion vulnerability that allows remote code execution when a user visits a malicious page or opens a malicious file. The flaw is triggered by JavaScript actions and runs with the current process context; exploitation requ...

CVE-2018-14266

CVE-2018-14266 affects Foxit Reader (notably 9.0.1.1049 and earlier) and is caused by a flaw in the importDataObject method that leads to a type confusion. An attacker can trigger this remotely by convincing a user to visit a malicious page or open a malicious file, initiating remote code executi...

CVE-2018-14296

Foxit Reader Circle Annotation use-after-free remote-code-execution vulnerability (CVE-2018-14296) affects Foxit Reader 9.0.1.5096 and earlier; exploits require user interaction (open a malicious file/page). The flaw lies in processing Circle annotations, where a pointer can be reused after free,...

CVE-2018-14305

CVE-2018-14305 affects Foxit Reader (notably 9.0.1.5096) and allows remote code execution via manipulation of PolyLine annotations during document processing. The flaw is a use-after-free in the annotation handling, exploitable when a user opens a malicious file or visits a malicious page, with u...

CVE-2018-17616

CVE-2018-17616 affects Foxit Reader 9.0.1.5096 for Windows. The vulnerability arises in the handling of onBlur events where the code fails to validate the existence of an object before operating on it, enabling remote code execution when a user opens a malicious file or visits a malicious page. T...

CVE-2018-17640

The CVE-2018-17640 issue affects Foxit Reader 9.2.0.9297 and earlier, where a failure to validate the existence of an object before manipulating the Form count property leads to a use-after-free condition. This allows remote code execution if a user visits a malicious page or opens a malicious fi...

CVE-2018-17647

CVE-2018-17647 affects Foxit Reader 9.2.0.9297 for Windows, where the boundItem method of a TimeField can be mishandled due to not validating the existence of an object, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file)....