Desktop Software

Memory Corruption

Foxit Reader - CPDF_Parser::m_pCryptoHandler - Use After Free - RCE

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code This vulnerability allows remote attackers to execute arbitrary code on vulnerable…

9.8
/ 10
Critical
CVSS v3.0
ADVISORY ID
PS23
PUBLISHED
2022-10-01
CVE IDs
CVE-2018-14442
VENDORS
Foxit Software
PUBLIC EXPLOIT
PoC public
CWE
CWE-416
PRODUCT
Foxit Reader / PhantomPDF 9.0.1.1049 and prior
CVSS VECTOR
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Abstract blurred background with dark tones and smooth gradient waves of blue, purple, and orange hues.
Summary

Overview

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of CPDF_Parser::m_pCryptoHandler. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process.

Vulnerability details

Vulnerability details

CVE-2018-14442
CWE-416
Critical | 9.8

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader.

Auth:
None (remote)
Impact:
Sensitive data disclosure, arbitrary data or code modification, denial of service
DISCLOSURE

Disclosure timeline

2018-01-08 Reported to vendor

2018-08-16 Coordinated public release of advisory

Credits

Sudhakar Verma and Ashfaq Ansari – Project Srishti