CVE-2018-17703 is a critical remote code execution vulnerability affecting Foxit Reader and PhantomPDF versions 9.2.0.9297 and earlier. The flaw stems from improper validation of ComboBox object properties, allowing an attacker to execute arbitrary code within the context of the current process. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, though user interaction is required. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is there any evidence of active exploitation, media coverage, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.2.0.9297CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:phantompdf:*:*:*:*:*:*:*:* | ||
<= 9.2.0.9297CPE matchmatch criteria | cpe:2.3:a:foxitsoftware:reader:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.