CVE-2021-27270 in PhantomPDF
Summary
by MITRE • 03/30/2021
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12230.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
The vulnerability identified as CVE-2021-27270 represents a critical security flaw in Foxit PhantomPDF version 10.1.0.37527 that enables remote code execution through improper handling of JPEG2000 image files. This vulnerability operates under the CWE-125 weakness category, which specifically addresses out-of-bounds read conditions where programs access memory beyond the boundaries of allocated structures. The flaw manifests during the parsing of JPEG2000 image formats, which are commonly used for high-quality document imaging and are frequently encountered in PDF documents. The attack vector requires user interaction, meaning that victims must either visit a malicious webpage or open a specially crafted malicious file containing the vulnerable JPEG2000 image data. This requirement for user interaction places the vulnerability in the context of social engineering attacks where attackers craft convincing phishing pages or malicious documents designed to lure users into triggering the exploit.
The technical implementation of this vulnerability stems from inadequate input validation mechanisms within the PDF viewer's image parsing subsystem. When the software encounters a JPEG2000 image, it fails to properly validate the structure and boundaries of the image data before attempting to read from memory locations. This oversight creates a condition where an attacker can craft malicious image data that causes the parser to read beyond allocated memory structures, potentially accessing sensitive memory regions or causing memory corruption that can be exploited to gain arbitrary code execution. The vulnerability operates at the process level, allowing an attacker to execute code with the privileges of the currently running PhantomPDF process, which typically runs with the permissions of the user who opened the document. This memory corruption vulnerability aligns with ATT&CK technique T1059.007 for command and scripting interpreter, as successful exploitation could enable attackers to execute arbitrary commands on the compromised system.
The operational impact of this vulnerability extends beyond simple code execution, as it provides attackers with a potential foothold for more extensive attacks within the victim's environment. Since the exploitation requires user interaction, attackers can leverage this vulnerability in targeted campaigns where they craft convincing phishing emails or malicious websites designed to entice users into opening compromised documents. The vulnerability's presence in a widely used PDF viewer like Foxit PhantomPDF means that successful exploitation could affect numerous enterprise environments where PDF document processing is common. Organizations using this software are particularly at risk since PDF files are frequently shared through email, file transfers, and web downloads, creating multiple attack vectors for threat actors. The vulnerability's classification under ZDI-CAN-12230 indicates it was recognized and tracked by the Zero Day Initiative, highlighting its significance in the cybersecurity community and the need for immediate remediation efforts. The combination of remote exploitability, user interaction requirement, and potential for privilege escalation makes this vulnerability particularly dangerous in enterprise environments where PDF processing is routine.