Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Foxit PDF Reader
Summary: Cisco Talos discovered four remote code execution vulnerabilities in Foxit PDF Reader version 9.7.0.29435, all use-after-free flaws in the program's JavaScript engine that a specially crafted PDF can trigger to reuse a freed object in memory and execute arbitrary code. An attacker must trick a user into opening a malicious PDF, though visiting a malicious site can also trigger the bugs if the browser plugin extension is enabled; Talos worked with Foxit to resolve the issues and release an update.
Key Takeaway: The exploit path is a user opening a PDF, and with the browser plugin enabled, merely visiting a malicious site is enough - so the patch status of every Foxit install, not just user caution, is what stands between an attacker and code execution.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5126CVE-2019-5130CVE-2019-5131CVE-2019-5145
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026