Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Foxit Reader can run malicious code remotely

CVE-2017-16571 · published 8 years ago
Summary

Foxit Reader version 8.3.1.21155 can be tricked into running harmful code when a user visits a malicious web page or opens a crafted file. The problem is caused by the program not checking certain data correctly, allowing attackers to insert their own commands. Advise users to update Foxit Reader to a newer version or apply the vendor's patch, and avoid opening unknown files or links.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
foxitsoftware foxit_reader 8.3.1.21155
cpe:2.3:a:foxitsoftware:foxit_reader:8.3.1.21155:*:*:*:*:*:*:*
Original advisory text
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the ...
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of references to the app object from FormCalc. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5072.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
3% chance of attack within 30 days
Type
CWE-843Type Confusion
CWE-704Incorrect Type Conversion or Cast
Timeline
Published20 Dec 2017
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-16571 · NVD
Track software like this
Free during beta