CVE-2018-14311: foxit foxit activex pro sdk Type Confusion
Vulnerability summary
CVE-2018-14311 is a high (CVSS 8.8) Type Confusion vulnerability in foxit foxit activex pro sdk. EPSS estimates a 2.74% chance of exploitation in the next 30 days, higher than 85.9% of scored vulnerabilities.
Timeline
- 31-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA events. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6331.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.74%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
-0.04 pp
From 2.77% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
- CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.
Affected systems
Foxitsoftware2 products
- foxit_reader≤ 9.1.0.5096
- phantompdf≤ 9.1.0.5096
Foxit1 product
- foxit activex pro sdk9.1.0.5096
2 vendors · 3 products