module
Foxit PDF Reader Pointer Overwrite UAF
| Disclosed |
|---|
| Apr 20, 2018 |
Disclosed
Apr 20, 2018
Description
Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability
in the Text Annotations component and the TypedArray's use
uninitialized pointers.
The vulnerabilities can be combined to leak a vtable memory address,
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.
This module has been tested on Windows 7 x64, Windows 10 Pro x64
Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise
must have insecure logons enabled for the exploit to work as expected.
in the Text Annotations component and the TypedArray's use
uninitialized pointers.
The vulnerabilities can be combined to leak a vtable memory address,
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.
This module has been tested on Windows 7 x64, Windows 10 Pro x64
Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise
must have insecure logons enabled for the exploit to work as expected.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.