CVE-2018-3956
An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader ver…
Published 7 y ago · modified 4 mo ago · JSON
Summary
An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read, which can disclose sensitive memory content and aid in exploitation when coupled with another vulnerability. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Exploit prediction (EPSS)
46.01% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.8 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
| CNA | 3.0 | 6.8 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:N/A:P |
Affected products
- Foxit Foxit
Classification
- Weakness
- CWE-125 Out-of-bounds Read
References
- talosintelligence.com /vulnerability_reports/TALOS-2018-0626 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-3956
- NVD: CVE-2018-3956
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.