CVE-2018-17607

Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-09-28

Last modified

2024-09-17

Weaknesses

CWE-416

Affected products

• Phantompdf (Foxitsoftware)
• Reader (Foxitsoftware)

References

• https://www.foxitsoftware.com/support/security-bulletins.php