CVE-2023-41257: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') in Foxit Foxit Reader
A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVE-2023-41257: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') in Foxit Foxit Reader
Description
A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- talos
- Date Reserved
- 2023-09-01T19:52:13.983Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 690a5549a730e5a3d9d77164
Added to database: 11/4/2025, 7:34:33 PM
Last updated: 11/4/2025, 7:35:36 PM
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
CVE-2023-5981: Observable Discrepancy in Red Hat Red Hat Enterprise Linux 8
MediumCVE-2023-5380: Use After Free in Red Hat Red Hat Enterprise Linux 7
MediumCVE-2023-5367: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
HighCVE-2023-5349: Missing Release of Memory after Effective Lifetime in rmagick
MediumCVE-2023-4693: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 8
MediumActions
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.