In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries…

Published 7 y ago 2018-12-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.4%

percentile 73%

Public exploits

none known

In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries using the DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access.

Exploit prediction (EPSS)

1.44% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

n/a Foxit Quick PDF Library

Classification

Weakness

CWE-787 Out-of-bounds Write
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

securityfocus.com /bid/106306 · vdb-entry, x_refsource_BID, x_transferred
foxitsoftware.com /support/security-bulletins.php · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-20249
NVD: CVE-2018-20249

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.