CVE-2020-26539

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V (in the Additional Action and Field dictionaries), a use-after-free can occur with resultant remote code execution (or an information leak).

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2020-10-02

Last modified

2024-08-04

Weaknesses

CWE-416

Affected products

• Foxit Reader (Foxitsoftware)
• Phantompdf (Foxitsoftware)

References

• https://www.foxitsoftware.com/support/security-bulletins.html