Vulnerability Spotlight: Multiple vulnerabilities in Foxit PDF Reader Java Script engine

Summary: Cisco Talos discovered multiple vulnerabilities in the JavaScript engine of Foxit PDF Reader version 10.1.0.37527, including a type confusion flaw (TALOS-2020-1165/CVE-2020-13547) and four use-after-free flaws that can lead to memory corruption and arbitrary code execution. An attacker triggers them by tricking a user into opening a specially crafted PDF, or by a malicious site if the browser plugin extension is enabled, and Talos worked with Foxit to disclose the issues and ensure an update is available.
What's compelling: A PDF reader with JavaScript enabled turns an ordinary document into an execution path, and the browser plugin extension means a malicious site alone can trigger it without a file ever being opened.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-13547
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026