Foxit PDF Reader 9.0.1.1049 Pointer Overwrite Use-After-Free
Posted by deepcore on August 25, 2018 – 6:11 am
Foxit PDF Reader version 9.0.1.1049 has a use-after-free vulnerability in the Text Annotations component and the TypedArray’s use uninitialized pointers. The vulnerabilities can be combined to leak a vtable memory address, which can be adjusted to point to the base address of the executable. A ROP chain can be constructed that will execute when Foxit Reader performs the UAF.
Post a reply
You must be logged in to post a comment.