Remote code execution vulnerabilities found in Buildroot, Foxit PDF Reader

Summary: Cisco Talos disclosed 10 vulnerabilities over two weeks, nine of them in Foxit PDF Reader, where malicious JavaScript or crafted files opened by the user can trigger use-after-free, type confusion, and arbitrary HTA file creation leading to arbitrary code execution. Talos also reported an integer overflow in the GPSd daemon (CVE-2023-43628) triggered by a crafted packet, and man-in-the-middle data integrity flaws in Buildroot (CVE-2023-43608 and related CVEs) that let an attacker execute code in the builder and tamper with generated files.
Bottom line: Nine of the ten flaws sit in a PDF reader with browser plugins for Chrome and Firefox, so a single opened document is the attack path into machines running it. The Buildroot flaws go further: an attacker who executes code in the builder can tamper with any file generated for its targets and hosts, compromising the firmware and embedded images downstream.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-31275 CVE-2023-32616 CVE-2023-35985 CVE-2023-38573 CVE-2023-39542 CVE-2023-40194 CVE-2023-41257 CVE-2023-43608 CVE-2023-43628 CVE-2023-45838 CVE-2023-45839 CVE-2023-45840 CVE-2023-45841 CVE-2023-45842
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026