Main Vulnerability Database Vulnerabilities #VU75354

Exposed dangerous method or function in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2023-27365

Published: April 19, 2023 / Updated: June 17, 2023

Vulnerability identifier: #VU75354

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-27365

CWE-ID: CWE-749

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improperly imposed security restrictions on macro-enabled documents when handling DOC files. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary macro without proper restrictions or consents from users.

Affected software

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

How to mitigate CVE-2023-27365

Install updates from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 10.1.12.37872, 11.2.6.53790, 12.1.2.15332
Foxit PDF Reader for Windows - update to 12.1.2.15332

External References

Related Security Bulletins