CVE-2020-13548CWE-416

In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution

High · published February 10, 2021

Patch now

High probability of exploitation

CVSS calls it high at 8.0. It sits in the 99.3th percentile for exploit probability.

CVSS v3.0
8.0
EPSS
66%
Percentile
99.3
In the wild
Unconfirmed
What it is

In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.65804 · 99.3th percentile
Weakness
CWE-416 · Use After Free
Published
2021-02-10T19:45Z
EPSS history
Timeline
  • 10 FEB 19:45Z
    In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution
    cvelistv5