Home

CVE-2021-31473

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the browseForDoc function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13523.

Risk Information

Base Score
7.8
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
6.075

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2021-21822 are fixed in Foxit Reader (ML) (10.1.4.37651)Windows
Vulnerabilities CVE-2021-31473 are affected in Foxit PhantomPDF 8 (ML) 10.1.3.37598Windows
Vulnerabilities CVE-2021-31473 are affected in Foxit PhantomPDF 8 10.1.3.37598Windows
Vulnerabilities CVE-2021-31473 are affected in Foxit PhantomPDF 9 (EXE) 9.7.5.29616Windows
Vulnerabilities CVE-2021-31473 are affected in Foxit PhantomPDF 9 (ML) (EXE) 10.1.3.37598Windows
Vulnerabilities CVE-2021-31473 are affected in Foxit PhantomPDF Slim 10.1.3.37598Windows
Vulnerabilities CVE-2021-31473 are affected in Foxit PhantomPDF 9 (MSI) 10.1.3.37598Windows
Vulnerabilities CVE-2021-31473 are affected in Foxit PhantomPDF 9 (ML) (MSI) 10.1.3.37598Windows
Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (EXE) (11.0.1.49938)Windows
Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (MSI) (11.0.1.49938)Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 8 (ML) 10.1.3.37598Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 8 (ML) 9.7.5.29616Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 8 10.1.3.37598Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 8 9.7.5.29616Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 10(EXE) 10.1.3.37598Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (EXE) 9.7.5.29616Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (ML) (EXE) 10.1.3.37598Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (ML) (EXE) 9.7.5.29616Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (ML) (MSI) 10.1.3.37598Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (ML) (MSI) 9.7.5.29616Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (MSI) 10.1.3.37598Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (MSI) 9.7.5.29616Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF Slim 10.1.3.37598Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF Slim 9.7.5.29616Windows
Multiple Vulnerabilities are affected in Foxit PhantomPDF 9 (EXE) 10.1.3.37598Windows
Multiple vulnerabilities are fixed in Foxit Reader (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit Reader (ML) (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit Reader Enterprise (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit Reader Enterprise (ML) (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (EXE) (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (MSI) (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (ML) (EXE) (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (ML) (MSI) (10.1.4.37651)Windows
Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (EXE) (11.0.1.49938)Windows
Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (MSI) (11.0.1.49938)Windows

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-319471Foxit Reader (ML) (10.1.4.37651)
PATCH-311706Foxit PhantomPDF 8 ML (8.3.12.47136)
PATCH-311625Foxit PhantomPDF 8 (8.3.12.47136)
PATCH-317727Foxit PhantomPDF 9 (ML) (EXE) (9.7.5.29616)
PATCH-306313Foxit PhantomPDF (MSI) (8.3.2) (Formerly Foxit PhantomPDF Slim)
PATCH-317729Foxit PhantomPDF 9 (MSI) (9.7.5.29616)
PATCH-317728Foxit PhantomPDF 9 (ML) (MSI) (9.7.5.29616)
PATCH-343981Foxit PDF Editor 11 (EXE) (11.2.12.54161)
PATCH-321157Foxit PDF Editor 11 (MSI) (11.0.1.49938)
PATCH-311706Foxit PhantomPDF 8 ML (8.3.12.47136)
PATCH-311706Foxit PhantomPDF 8 ML (8.3.12.47136)
PATCH-311625Foxit PhantomPDF 8 (8.3.12.47136)
PATCH-311625Foxit PhantomPDF 8 (8.3.12.47136)
PATCH-317727Foxit PhantomPDF 9 (ML) (EXE) (9.7.5.29616)
PATCH-317727Foxit PhantomPDF 9 (ML) (EXE) (9.7.5.29616)
PATCH-317728Foxit PhantomPDF 9 (ML) (MSI) (9.7.5.29616)
PATCH-317728Foxit PhantomPDF 9 (ML) (MSI) (9.7.5.29616)
PATCH-317729Foxit PhantomPDF 9 (MSI) (9.7.5.29616)
PATCH-317729Foxit PhantomPDF 9 (MSI) (9.7.5.29616)
PATCH-306313Foxit PhantomPDF (MSI) (8.3.2) (Formerly Foxit PhantomPDF Slim)
PATCH-306313Foxit PhantomPDF (MSI) (8.3.2) (Formerly Foxit PhantomPDF Slim)
PATCH-347386Foxit Reader (2025.1.0.27937)
PATCH-351917Foxit Reader (ML) (2025.2.1.33197)
PATCH-347385Foxit PDF Reader (MSI) (2025.1.0.27937)
PATCH-351864Foxit PDF Reader (ML) (MSI) (2025.2.0.33046)
PATCH-331212Foxit PhantomPDF 10 (EXE) (10.1.12.37872)
PATCH-331215Foxit PhantomPDF 10 (MSI) (10.1.12.37872)
PATCH-331213Foxit PhantomPDF 10 (ML) (EXE) (10.1.12.37872)
PATCH-331214Foxit PhantomPDF 10 (ML) (MSI) (10.1.12.37872)
PATCH-343982Foxit PDF Editor 11 (ML) (EXE) (11.2.12.54161)
PATCH-343983Foxit PDF Editor 11 (ML) (MSI) (11.2.12.54161)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234