Description

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:11.453Z",
  "pubdate": "2026-09-23T08:17:11.453Z",
  "executiveSummary": "The vulnerability resides within the FileOpen plugin utilized by Foxit PDF Editor and Reader. It is classified as an improper input validation flaw regarding encryption metadata within PDF documents.\nSuccessful exploitation allows an unauthenticated, remote attacker to trigger a state of memory corruption by supplying a specially crafted PDF file.\nThe core issue involves the improper handling of encryption metadata, which causes an internal pointer to enter an invalid state. This corruption facilitates chained read and write access violations, potentially enabling arbitrary code execution within the context of the application process.\nThe impact includes full compromise of the application's process space, potentially leading to unauthorized data access, system instability, or the installation of malicious software.\nExploitation requires the victim to open a maliciously crafted file, typically delivered via email or web download. Given the nature of PDF processing, this vulnerability presents a significant risk to workstations handling external documents.",
  "technicalDetails": "The vulnerability is rooted in the FileOpen plugin's insufficient validation of encryption-related metadata fields during the parsing of PDF documents. When a PDF file is opened, the plugin processes embedded metadata to determine document security parameters. If the metadata is malformed, specifically involving lengths or offset values associated with encryption buffers, the parser fails to perform bounds checking or integrity verification.\nThe exploitation flow begins when the plugin attempts to interpret these malformed metadata fields. Due to the lack of validation, the plugin assigns unexpected values to internal pointers responsible for tracking memory addresses during the decryption or initialization process. By providing precise, crafted values, an attacker can induce an invalid pointer state, effectively corrupting the internal heap structure.\nThis memory corruption manifests as a sequence of chained memory access violations. The attacker leverages these primitives to gain read and write access to unauthorized memory segments. By successfully overwriting function pointers, vtable entries, or other critical control flow data, the attacker can redirect the execution flow of the Foxit PDF process to attacker-supplied shellcode or execute Return-Oriented Programming (ROP) chains.\nThe vulnerable component is identified as the FileOpen plugin within the Foxit PDF ecosystem. Exploitation is typically client-side, requiring the target user to interact with a malicious file. No prior authentication is required, as the vulnerability is triggered during the standard document rendering and security initialization process. The privilege level of the subsequent arbitrary code execution is limited to the current user's security context. Post-exploitation, the attacker can leverage the persistence of the compromised process to exfiltrate documents, harvest local credentials, or achieve further lateral movement within the network if the user is running the application with elevated permissions."
}