Vulnerability · Published Nov 21, 2022 · Assigned by talos
CVE-2022-37332
High 8.8
In plain English
A high-severity use-after-free in Foxit Reader from Foxit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing media player API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Foxit | Foxit Reader | 12.0.1.12430 |
Weakness: CWE-416 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H