CVE-2021-31468 is a high-severity vulnerability affecting Foxit Reader version 10.1.3.37598, specifically its handling of U3D files embedded in PDF documents. This flaw, categorized as a read past the end of an allocated data structure (CWE-125), allows remote attackers to execute arbitrary code. Exploitation requires user interaction, as the target must open a malicious PDF or visit a malicious page, making it a local attack vector with low complexity. Successful exploitation grants the attacker code execution in the context of the current process, leading to high impacts on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.7.4.29600CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:3d:*:*:*:*:*:foxit_reader:*:* | ||
<= 9.7.4.29600CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:3d:*:*:*:*:*:phantompdf:*:* | ||
>= 10.0.0.0, <= 10.1.3.37598CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:3d:*:*:*:*:*:foxit_reader:*:* | ||
>= 10.0.0.0, <= 10.1.3.37598CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:3d:*:*:*:*:*:phantompdf:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.