CVE-2021-21822

2021-05-1015:02:51

CWE-416

talos

www.cve.org

vulnerability

pdf reader

arbitrary code execution

javascript engine

memory reuse

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.007

Percentile

80.2%

JSON

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled.

CNA Affected

[
  {
    "product": "Foxit",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Foxit Reader 10.1.3.37598"
      }
    ]
  }
]