Type confusion in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2018-7407

Vulnerability identifier: #VU12833

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7407

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion. A remote attacker can execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

Install update from vendor's website.

• https://www.foxitsoftware.com/support/security-bulletins.php

• Multiple vulnerabilities in Foxit Reader and PhantomPDF