CVE-2018-10488

CVE-2018-10488 is a critical remote code execution vulnerability affecting Foxit Reader version 9.0.0.29935 and Foxit PhantomPDF. The flaw stems from improper validation of user-supplied data length during U3D Texture Width structure parsing, leading to a heap-based buffer overflow. Exploitation requires user interaction, typically by opening a malicious file or visiting a malicious webpage. With a CVSS score of 8.8 (High), successful exploitation grants an attacker the ability to execute arbitrary code within the context of the current process, leading to high impact on confidentiality, integrity, and availability. There is no known public exploit code, Metasploit module, or evidence of active exploitation, and it has garnered minimal community discussion or media coverage.