Improper validation of array index in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2018-7406

Vulnerability identifier: #VU12834

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7406

CWE-ID: CWE-129

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to parsing validation indexing. A remote attacker can execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

Install update from vendor's website.

• https://www.foxitsoftware.com/support/security-bulletins.php

• Multiple vulnerabilities in Foxit Reader and PhantomPDF