CVE-2018-17608

Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of…

published September 28, 2018

CVSS
—
EPSS
3%
Percentile
88.0
In the wild
Unconfirmed
What it is

🚨 A clever mishandling of Annotation objects in Foxit PhantomPDF and Reader could give attackers the keys to your system! Think of it like a waiter who messes up your order and accidentally brings out a dish meant for someone else — if they aren't careful, they might serve you something explosive! 🍽️ This flaw allows remote attackers to execute arbitrary code or cause a denial of service, creating a surprisingly sneaky way for malicious users to hijack your documents or crash your system. Imagine the chaos if your trusted PDF viewer turns rogue!

Put simply

Think of it like a waiter who messes up your order and accidentally brings out a dish meant for someone else — if they aren't careful, they might serve you something explosive! 🍽️ The vulnerability arises from a use-after-free error in handling properties of Annotation objects, which could lead to an attacker executing arbitrary code when the application processes certain files.

What to do

This flaw allows remote attackers to execute arbitrary code or cause a denial of service, creating a surprisingly sneaky way for malicious users to hijack your documents or crash your system. Imagine the chaos if your trusted PDF viewer turns rogue! To protect yourself, update to Foxit PhantomPDF and Reader version 9.3 or later immediately! Regularly check for updates to ensure you’re always safeguarded against potential vulnerabilities like this. You've got this, security hero! 🛡️ Stay sharp and keep your software updated!

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03176 · 88.0th percentile
Published
2018-09-28T09:00Z
EPSS history
Timeline
  • 28 SEP 09:00Z
    Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of…
    cvelistv5