CVE-2018-14280

CVE-2018-14280 is a critical arbitrary code execution vulnerability affecting Foxit Reader and PhantomPDF versions 9.0.1.1049 and earlier. This flaw, stemming from improper validation in the exportAsFDF XFA function, allows remote attackers to write arbitrary files and execute code with user interaction, typically by opening a malicious file or visiting a malicious page. With a CVSS score of 8.8 (High), it presents a significant risk due to its network attack vector and high impact on confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or active exploitation have been identified, and community discussion is minimal, the potential for severe compromise necessitates awareness.