A vulnerability classified as critical was found in Foxit Reader up to 9.5.0 (Document Reader Software). Affected by this vulnerability is some unknown functionality of the component Acroform Object Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8864.

The weakness was released 10/03/2019. This vulnerability is known as CVE-2019-13326 since 07/05/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Upgrading to version 9.5.0.20723 eliminates this vulnerability.

Entries connected to this vulnerability are available at 142925, 142924, 142923 and 142922.

Productinfo

Type

• Document Reader Software

Vendor

• Foxit

Name

• Reader

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion