Arbitrary code execution in Foxit PDF Reader for Windows and Foxit PDF Editor (formerly Foxit PhantomPDF) - #VU1030

Vulnerability identifier: #VU1030

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: N/A

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Foxit Software Inc.

Affected software:
Foxit PDF Reader for Windows
Foxit PDF Editor (formerly Foxit PhantomPDF)

The vulnerability allows a remote unauthenticated user to execute arbitrary code on the target system.
The weakness is due to heap corruption and lets attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Update Foxit Reader to version 8.1.
Update Foxit PhantomPDF to version 8.1.

• https://www.foxitsoftware.com/support/security-bulletins.php