CVE-2018-14245 is a critical remote code execution vulnerability affecting Foxit Reader and PhantomPDF versions 9.0.1.1049 and earlier. It stems from a type confusion flaw within the closeDoc method, exploitable via malicious JavaScript when a user opens a specially crafted file or visits a malicious web page. With a CVSS score of 8.8 (High), successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, leading to full compromise of confidentiality, integrity, and availability. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is it listed on CISA's KEV catalog, indicating no known active exploitation. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.1.0.5096CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:foxit_reader:*:*:*:*:*:*:*:* | ||
<= 9.1.0.5096CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:phantompdf:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.