CVE-2020-8856 is a remote code execution vulnerability affecting Foxit PhantomPDF and Reader on Windows, specifically version 9.6.0.25608. It stems from improper handling of watermarks, where the software fails to validate an object's existence before operations, allowing an attacker to execute arbitrary code within the user's process. This high-severity vulnerability (CVSS 7.8) requires user interaction, typically by opening a malicious file or visiting a malicious page. While no public exploits or Metasploit modules are available, and community discussion is minimal, its FAUCET Risk Score of 86/100 indicates significant potential impact if exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.7.0.29478CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:reader:*:*:*:*:*:*:*:* | ||
<= 9.7.0.29455CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:phantompdf:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.