CVE-2018-20248CWE-787

In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table pointers or invalid…

published December 24, 2018

CVSS
—
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

⚠️ A malformed PDF can trigger chaos in Foxit Quick PDF Library, causing memory access issues like a surprise guest crashing a party! Think of the Quick PDF Library as a party planner. If someone hands them a chaotic list of guests (the malformed PDF), they might accidentally let in someone who causes havoc! This flaw could lead to an access violation, potentially crashing the application or exposing sensitive information. While it’s not actively exploited, it’s a sneaky risk lurking in the shadows that could disrupt your PDF handling.

Put simply

Think of the Quick PDF Library as a party planner. If someone hands them a chaotic list of guests (the malformed PDF), they might accidentally let in someone who causes havoc! In Foxit Quick PDF Library versions prior to 16.12, loading malformed PDFs can cause out-of-bounds memory access due to invalid xref table pointers or data, leading to unexpected behavior and crashes.

What to do

This flaw could lead to an access violation, potentially crashing the application or exposing sensitive information. While it’s not actively exploited, it’s a sneaky risk lurking in the shadows that could disrupt your PDF handling. To protect your applications, upgrade to Foxit Quick PDF Library version 16.12 or later. It's essential to audit any existing PDF handling functions to ensure they are robust against malformed inputs. You've got this! Follow these steps, and you'll tighten up your PDF defenses in no time! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01652 · 76.3th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2018-12-24T19:00Z
EPSS history
Timeline
  • 24 DEC 19:00Z
    In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table pointers or invalid…
    cvelistv5