CVE-2020-8849 HIGH

CVE-2020-8849

Vendor Foxit
Product Reader
Weakness CWE-787
Published February 13, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9413.

Key dates

02Disclosure timeline

February 13, 2020 CVE published
August 4, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-3900 Out-of-bounds stack array write in Xpdf 4.05 due to missing zero check CVE-2023-38087 Kofax Power PDF clearTimeOut Out-Of-Bounds Write Remote Code Execution Vulnerability CVE-2024-30297 When Adobe Animate parses FLA files, there is a heap out-of-bounds write vulnerability at Animate.exe+0x125D391 CVE-2021-21052 Adobe Animate Out-of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access