Description

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:13.790Z",
  "pubdate": "2026-09-23T08:17:13.790Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds heap buffer write in Foxit PDF Editor and Reader caused by insufficient validation of JPEG2000 image metadata within a PDF file.\nThe flaw stems from improper sanitization of image parameters during the decoding process, which can lead to memory corruption.\nSuccessful exploitation allows an unauthenticated, remote attacker to trigger an application crash, potentially leading to arbitrary code execution within the context of the user running the application.\nThe risk is critical, as it requires no user interaction beyond opening a specially crafted PDF document, facilitating potential malware delivery or remote compromise.",
  "technicalDetails": "The vulnerability resides within the JPEG2000 image parsing engine utilized by Foxit PDF Editor and Reader. During the image decoding phase, the application attempts to process metadata fields contained within the JPEG2000 data stream without adequate verification of field bounds.\nWhen a malicious PDF file contains a JPEG2000 image with manipulated metadata—specifically, dimensions or header parameters that deviate from the expected structure—the application fails to validate the allocated buffer size against the incoming data length.\nThe exploitation flow begins when the PDF parser identifies the JPEG2000 stream and invokes the vulnerable decoder. An attacker crafts a malformed metadata header that directs the decoder to write processed image data into a heap-allocated buffer. Due to the lack of sufficient boundary checks, the decoder proceeds to write data beyond the end of the destination heap buffer, resulting in an out-of-bounds write.\nThis heap-based overflow can be leveraged to corrupt adjacent objects in the heap memory. By carefully structuring the heap layout, an attacker can overwrite critical data structures, such as function pointers or object vtables, thereby redirecting the application's execution flow. Once control flow is hijacked, the attacker can execute arbitrary shellcode or perform Return-Oriented Programming (ROP) to bypass system-level protections like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).\nBecause the vulnerability is triggered during the standard parsing of embedded document objects, it does not require prior authentication or elevated privileges. The impact of successful exploitation is localized to the user session, but it provides the adversary with the same level of access as the logged-in user, potentially allowing for further privilege escalation or persistent system compromise."
}