CVE-2022-24954

critical · 9.8

Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpan="-2"' and 'draw colSpan="1"' substrings.

9.8

CVSS

11.9%

EPSS (exploit prob.)

96th

EPSS percentile

2022-02-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
foxit	pdf_reader	<= 11.1.0.52543
microsoft	windows	all versions
foxit	pdf_editor	<= 10.1.6.37749
foxit	pdf_editor	>= 11.0.1.0719, <= 11.2.0.53415
microsoft	windows	all versions

Check a specific version with /api/v1/cve/match.

References

https://twitter.com/l33d0hyun/status/1487047927415459851
https://www.foxit.com/support/security-bulletins.html
https://twitter.com/l33d0hyun/status/1487047927415459851
https://www.foxit.com/support/security-bulletins.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-24954