Vulnerability Spotlight: Multiple Issues in Foxit PDF Reader
Summary: Cisco Talos disclosed TALOS-2018-0626 / CVE-2018-3956, an out-of-bounds read in Foxit PDF Reader that can disclose sensitive memory content and, combined with other vulnerabilities, aid in full compromise. The attack can be triggered by tricking a user into opening a malicious PDF or, if the browser plugin is enabled, by simply viewing the document in a web browser.
Why it matters: The same advisory describes multiple use-after-free conditions in Foxit's JavaScript engine, including ones reachable through page open and page close actions and through form-field methods such as signatureInfo and signatureGetSeedValue, so a single crafted PDF has several paths to exploitation.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-3956
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026