CVE-2020-15638 in PhantomPDF
Summary
by MITRE
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the NodeProperties::InferReceiverMapsUnsafe method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10950.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
The vulnerability identified as CVE-2020-15638 represents a critical security flaw in Foxit PhantomPDF version 9.7.2.29539 that enables remote code execution through a type confusion vulnerability within the NodeProperties::InferReceiverMapsUnsafe method. This issue falls under the CWE-1289 category of Type Confusion, where the software fails to properly validate or handle data types during processing operations. The vulnerability requires user interaction to be exploited, meaning that an attacker must convince a target to visit a malicious webpage or open a crafted malicious file containing the exploit payload. The attack vector demonstrates a typical social engineering component that leverages user trust and browsing behavior to deliver malicious content.
The technical flaw manifests in the NodeProperties::InferReceiverMapsUnsafe method where insufficient validation of user-supplied data leads to a type confusion condition. When processing malicious input, the application fails to properly validate data types, causing the software to incorrectly interpret memory structures and potentially execute arbitrary code within the context of the current process. This type confusion vulnerability allows an attacker to manipulate memory layout and execute malicious instructions with the privileges of the targeted application. The vulnerability's exploitation requires careful crafting of input data that can manipulate the application's internal type handling mechanisms, leading to unauthorized code execution.
The operational impact of this vulnerability is significant as it provides remote attackers with a means to gain control over affected systems without requiring local access or elevated privileges. Once successfully exploited, the attacker can execute arbitrary code with the same privileges as the PhantomPDF application, potentially leading to full system compromise. This vulnerability affects organizations that rely on Foxit PhantomPDF for document processing, as it creates an attack surface that can be exploited through web browsing or document handling activities. The remote execution capability makes this particularly dangerous in enterprise environments where users may encounter malicious content through various digital channels.
Security mitigations for this vulnerability should include immediate patching of affected Foxit PhantomPDF installations to the latest version that addresses the type confusion issue. Organizations should implement network-based protections such as web application firewalls and content filtering to prevent access to known malicious domains. Additionally, user education and awareness programs should be strengthened to reduce the likelihood of successful social engineering attacks that deliver the malicious payloads. The vulnerability aligns with ATT&CK technique T1203 (Exploitation for Client Execution) and T1059 (Command and Scripting Interpreter) as it leverages application vulnerabilities to execute code remotely. System administrators should also consider implementing least privilege principles and monitoring for suspicious process execution patterns that could indicate exploitation attempts, while maintaining up-to-date threat intelligence to identify related attack campaigns targeting similar vulnerabilities in PDF processing applications.