Main Vulnerability Database Vulnerabilities #VU12043

Memory corruption in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2018-3842

Published: April 20, 2018 / Updated: April 21, 2018

Vulnerability identifier: #VU12043

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-3842

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error. A remote attacker can use of uninitialized new Uint32Array object or member variables in PrintParams or m_pCurContex objects, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

How to mitigate CVE-2018-3842

Update to version 9.1.

External References

https://www.foxitsoftware.com/support/security-bulletins.php

Related Security Bulletins