CVE-2021-40326

EUVD-2021-27506
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Affected Products (NVD)
VendorProductVersion
foxitpdf_editor
11.0 ≤
𝑥
< 11.1
foxitpdf_reader
11.0 ≤
𝑥
< 11.1
foxitphantompdf
𝑥
< 10.1.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.foxit.com/support/security-bulletins.html
https://www.foxit.com/support/security-bulletins.html