Cybersecurity specialists reported the finding of multiple critical vulnerabilities in Foxit PDF Reader and Foxit PhantomPDF. According to the report, the reported flaws would allow the deployment of multiple variants of attacks, including out of bounds writing and arbitrary code execution.

Below are brief descriptions of the reported flaws, in addition to their respective tracking keys and scores assigned by the Common Vulnerability Scoring System (CVSS).

CVE-2021-27270: A boundary condition within JPEG2000 image analysis allows remote threat actors to create a specially designed file, trick the victim into opening it, trigger an out-of-bounds read error, and read memory content on the system.

The flaw received a CVSS score of 5.7/10.

CVE-2021-27271: A boundary error within handling U3D objects embedded in PDF files in U3DBrowser allows hackers to create a specially designed PDF document, trick the victim into opening it, cause memory corruption and execute arbitrary code.

This is a critical flaw and received a score of 7.1/10.

CVE-2021-27269: A boundary error in handling U3D objects in PDF files would allow malicious hackers to create a specially designed PDF file and use it to execute code on the target system.

Cybersecurity experts consider this to be a severe flaw and received a CVSS score of 7.7/10.

CVE-2021-27268: A use-after-free error in handling U3D objects in PDF files. A remote attacker can create a specially designed PDF file, trick the victim into opening it, trigger a usage error after release, and execute arbitrary code on the system.

The flaw received a score of 7.7/10.

CVE-2021-27267: A use-after-free flaw in handling U3D objects in PDF files would allow remote attackers to create a specially designed PDF file to trick the victim and trigger an arbitrary code execution scenario on the system.

The vulnerability also received a CVSS score of 7.7/10.

CVE-2021-27266: The vulnerability exists due to a boundary condition within the handling of U3D objects embedded in PDF files. Remote hackers can create a specially designed file and access memory content on the system.

This vulnerability received a CVSS score of 7.7/10.

CVE-2021-27265: A boundary condition within the handling of U3D objects embedded in PDF files allows the creation of specially designed files and generate an out-of-bounds reading in the memory of the target system.

The flaw received a score of 5.7/10.

CVE-2021-27264: A boundary condition within handling U3D objects embedded in PDF files allows threat actors to create files specially designed to trigger system memory errors.

This flaw received a CVSS score of 5.7/10.

CVE-2021-27263: A boundary condition within handling U3D objects embedded in PDF files allows remote attackers to create a file specially designed to access the memory content of the affected system.

The vulnerability received a CVSS score of 5.7/10, cybersecurity specialists report.

CVE-2021-27262: A boundary condition within handling U3D objects embedded in PDF files allows remote attackers to create specially designed files to trigger an out-of-bounds read and access system memory content.

The flaw received a score of 5.7/10.

CVE-2021-27261: A boundary condition within handling U3D objects in PDF files would allow remote malicious hackers to use specially designed files to access vulnerable memory content.

This flaw received a CVSS score of 5.7/10.

Flaws reside in the following versions of the affected solutions:

  • Foxit Reader for Windows: 10.0.0.35798, 10.0.1, 10.0.1.35811, 10.1, 10.1.0.37527, 10.1.1, 10.1.1.37576
  • Foxit PhantomPDF: 10.0.0.35798, 10.0.1, 10.0.1.35811, 10.1.0.37527, 10.1.1, 10.1.1.37576

Although most of these flaws can be exploited remotely by unauthenticated threat actors, cybersecurity experts report that so far no active exploit attempts or malware variants associated with the attack have been reported.

Updates are now available, so Foxit recommends users of affected deployments update as soon as possible.