CVE-2018-11623: foxit foxit reader Type Confusion
Vulnerability summary
CVE-2018-11623 is a high (CVSS 8.8) Type Confusion vulnerability in foxit foxit reader. EPSS estimates a 2.84% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities.
Timeline
- 31-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAdLayer method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6003.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.84%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
-0.04 pp
From 2.88% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
- CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.
Affected systems
Foxitsoftware2 products
- foxit_reader≤ 9.1.0.5096
- phantompdf≤ 9.1.0.5096
Foxit1 product
- foxit reader9.0.1.1049
2 vendors · 3 products