Main Vulnerability Database Vulnerabilities #VU75353

Exposed dangerous method or function in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2023-27364

Published: April 19, 2023 / Updated: June 17, 2023

Vulnerability identifier: #VU75353

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-27364

CWE-ID: CWE-749

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improperly imposed security restrictions on macro-enabled documents when handling XLS files. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary macro without proper restrictions or consents from users.

Affected software

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

How to mitigate CVE-2023-27364

Install updates from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 10.1.12.37872, 11.2.6.53790, 12.1.2.15332
Foxit PDF Reader for Windows - update to 12.1.2.15332

External References

Related Security Bulletins